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Inspection  policies  are  essential  for  many  types  of 
systems  for  which  the  status  (functioning  or  failed)  can  be 
determined  only  by  actual  inspection.  Two  types  of 
inspection  error  may  occur.  A  functioning  system  may  be 
incorrectly  assessed  as  having  failed  or  a  failed  system  may 
be  incorrectly  assessed  as  functioning.  These  errors  are 
designated  as  Types  I  and  II  respectively,  and  their  impact 
on  optimal  inspection  policies  and  software  fault  detection 
models  is  analyzed.  For  a  periodic  inspection  model  with 
Type  I  error,  an  optimal  replacement  age  is  obtained,  then 
monotonicity  and  asymptotic  properties  of  the  long-run 
expected  cost  per  unit  of  time  are  presented.  Type  I  error 
is  incorporated  into  a  cumulative  damage  model.  When  the 
failure  density  is  reverse  rule  of  order  2,  an  algorithm  to 
compute  an  optimal  inspection  sequence  is  derived,  and  it  is 
proven  that  optimal  intervals  are  increasing.  Extending  the 
optimal  inspection  sequence  model  of  Barlow,  Hunter,  and 
Proschan  to  include  Type  II  inspection  error,  it  is  proven 
that  optimal  intervals  are  nonincreasing  for  a  PFj  density. 


and  an  algorithm  to  compute  optimal  intervals  is  derived. 
Additionally,  monotonicity  and  majorization  results  are 
obtained  for  an  optimal  inspection  sequence  with  Type  ll 
error.  The  impact  of  fault-detection  error  on  a  software 
optimal  release  time  model  is  shown.  The  effect  of  fault 
diversity  on  the  Jelinski-Moranda  model  and  how  this  relates 
to  imperfect  fault  detection  is  demonstrated. 
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Abstract 


Inspection  policies  are  essential  for  many  types  of 
systems  for  which  the  status  (functioning  or  failed)  can  be 
determined  only  by  actual  inspection.  Two  types  of 
inspection  error  may  occur.  A  functioning  system  may  be 
incorrectly  assessed  as  having  failed  or  a  failed  system  may 
be  incorrectly  assessed  as  functioning.  These  errors  are 
designated  as  Types  I  and  II  respectively,  and  their  impact 
on  optimal  inspection  policies  and  software  fault  detection 
models  is  analyzed.  For  a  periodic  inspection  model  with 
Type  I  error,  an  optimal  replacement  age  is  obtained,  then 
monotonicity  and  asymptotic  properties  of  the  long-run 
expected  cost  per  unit  of  time  are  presented.  Type  I  error 
is  incorporated  into  a  cumulative  damage  model.  When  the 
failure  density  is  reverse  rule  of  order  2,  an  algorithm  to 
compute  an  optimal  inspection  sequence  is  derived,  and  it  is 
proven  that  optimal  intervals  are  increasing.  Extending  the 
optimal  inspection  sequence  model  of  Barlow,  Hunter,  and 
Proschan  to  include  Type  II  inspection  error,  it  is  proven 
that  optimal  intervals  are  nonincreasing  for  a  PF2  density, 
and  an  algorithm  to  compute  optimal  intervals  is  derived. 
Additionally,  monotonicity  and  majorization  results  are 


X 


obtained  for  an  optimal  inspection  sequence  with  Type  II 
error.  The  impact  of  fault-detection  error  on  a  software 
optimal  release  time  model  is  shown.  The  effect  of  fault 
diversity  on  the  Jelinski-Moranda  model  and  how  this  relates 
to  imperfect  fault  detection  is  demonstrated. 


1.  INTRODUCTION  AND  SUMMARY 


.  Importance  of  Inspection  Models. 

Inspection  policies  are  essential  for  many  types  of 
systems  for  which  the  status  (functioning  or  failed)  can  be 
determined  only  by  actual  inspection.  Safety  and  security 
systems  are  prime  examples.  Events  such  as  the  April  1986 
nuclear  reactor  accident  at  Chernobyl  and  the  December  1984 
chemical  leak  at  Bhopal  remind  us  of  the  importance  of 
safety  devices  in  system  design  and  of  the  need  for  optimal 
scheduling  of  inspection.  Inspection  policies  also  have 
applications  in  environmental  control,  medical  screening, 
and  inventory  optimization. 

An  inspection  error  may  be  due  to  human  error  or 
malfunction  of  a  detection  device.  A  simple  example  is  a 
fire  extinguisher  which  is  checked  periodically.  If  the 
pressure  gauge  malfunctions,  it  may  erroneously  indicate 
the  extinguisher  is  empty,  and  so  the  extinguisher  is 
unnecessarily  replaced. 

The  consequences  of  inspection  error  can  be  very 
costly.  Failure  to  identify  an  0-ring  problem  resulted  in 
the  explosion  of  the  space  shuttle  Challenger  on  January 
28,  1986.  Nine  passengers  were  killed  and  23  injured  when 
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the  failure  of  a  cargo  door  latch  ruptured  the  skin  and  a 
large  section  of  the  fuselage  ripped  away  from  the  19  year 
old  United  Airlines  Boeing  747  enroute  from  Hawaii  on 
February  25,  1989.  Ironically  the  Federal  Aviation 
Administration  had  ordered  inspection  of  all  747  cargo  door 
latches  the  previous  year. 

1.2  Imperfect  Repair  Models. 

Recent  work  on  maintenance  models  takes  into  account 
additional  real-world  factors  such  as  "minimal"  or 
"imperfect"  repair  action.  Brown  and  Proschan  (1983a) 
proposed  several  different  imperfect  maintenance  and 
imperfect  inspection  models  and  (1983b)  studied  properties 
of  the  distribution  of  the  time  between  perfect  repairs. 
Fontenot  and  Proschan  (1984)  'then  developed  optimal 
policies  for  several  maintenance  models  based  on  the 
imperfect  repair  model  of  Brown  and  Proschan  (1983b) . 

Block,  Borges,  and  Savits  (1985)  extended  the  results  of 
Brown  and  Proschan  (1983b)  by  allowing  the  probability  of 
imperfect  repair  to  depend  on  the  age  of  the  equipment. 

Chan  and  Sethuraman  (1985)  compared  the  expected  number  of 
failures  by  time  t  in  several  different  minimal  repair 
models.  Nakagawa  (1981)  analyzed  generalized  models  for 
determining  the  optimal  number  of  minimal  repairs  before 
replacement. 
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1.3  Inspection  Models. 

Another  real  world  factor,  imperfect  inspection,  has 
not  been  considered  as  extensively  in  the  literature.  Many 
inspection  models  assume  perfect  inspection.  Savage  (1956) 
showed  how  to  choose  an  optimal  replacement  procedure  for  a 
"preparedness”  model,  where  equipment  is  kept  in  storage 
until  an  emergency  occurs.  Derman  and  Sacks  (1960)  solved 
the  problem  of  choosing  an  optimal  replacement  rule  for 
deteriorating  equipment,  where  the  amount  of  deterioration 
is  observed  periodically.  Barlow,  Hunter,  and  Proschan 
(1963)  showed  how  to  obtain  optimum  inspection  schedules 
for  a  broad  class  of  failure  distributions.  Taylor  (1975), 
assuming  a  cumulative  damage  model  for  system  failure, 
found  an  optimal  replacement  strategy  that  minimized  the 
long-run  expected  cost  per  unit  of  time.  Abdel-Hameed 
(1986)  obtained  an  optimal  periodic  replacement  policy  for 
a  system  subject  to  shocks  which  are  modeled  by  any 
counting  process  with  jump  size  one.  For  systems  which 
fail  when  cumulative  continuous  wear  reaches  a  threshold. 
Park  (1988)  derived  an  optimal  replacement  policy  under 
periodic  inspections.  Parmigiani  (1990a)  derived  a 
Bayesian  decision  rule  for  optimal  scheduling  of 
inspections  when  the  distribution  of  failure  times  is  not 
fully  known. 
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1.4  Type  I  and  II  Inspection  Errors. 

Although  perfect  inspection  is  often  assumed,  that  is, 
no  error  is  made  in  assessing  the  status  of  the  system, 
two  types  of  inspection  error  may  actually  occur.  A 
functioning  system  may  be  incorrectly  assessed  as  having 
failed  or  a  failed  system  may  be  incorrectly  assessed  as 
functioning.  Designate  these  errors  as  Type  I  and  Type  II 
respectively,  analogous  to  Type  I  and  Type  II  errors  in 
hypothesis  testing. 

1.5.  Imperfect  Inspection  Models. 

Assuming  Type  II  inspection  error,  Derman  (1961) 
obtained  the  minimax  inspection  schedule  for  an  unknown 
failure  distribution.  Weiss  (1962)  assumed  Type  II  error 
in  his  periodic  inspection  model  and  obtained  the 
asymptotic  availability  of  a  system  with  exponential 
failure  distribution.  Luss  and  Kander  (1974)  obtained 
optimal  inspection  policies  for  a  system  which  continues  to 
operate  during  inspection.  They  assumed  that  the  failure 
of  a  system  prior  to  an  inspection  is  detected  with 
probability  one,  but  allowed  for  the  occurrence  of  both 
Type  I  and  Type  II  inspection  errors  during  system 
checking.  Kaio  and  Osaki  (1984)  introduced  Type  II  error 
into  Keller's  (1974,  1982)  models  for  near-optimum 
inspection  schedules  using  an  inspection  density. 

Assuming  an  exponential  failure  density,  Sengupta 
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(1982)  extended  the  model  of  Barlow,  Hunter,  and  Proschan 
(1963)  to  obtain  optimum  inspection  schedules  with  Type  II 
inspection  error.  Parmigiani  (1990d)  further  extended  this 
model  for  any  log-concave  failure  density  with  both  Type  I 
and  Type  II  errors.  A  decision  theoretic  model  for  optimal 
screening  ages  for  detection  of  chronic  diseases  was 
presented  by  Parmigiani  ( 1990b, d) .  Merge,  Proschan,  and 
Sethuraman  (1986)  obtained  an  optimal  replacement  age  under 
Type  I  inspection  error.  With  Type  II  error,  Parmigiani 
(1990c)  obtained  optimal  one-test  and  two-test  policies  to 
avoid  replacing  a  functioning  unit. 

1.6  Imperfect  Detection  of  Software  Faults. 

Corresponding  to  the  problem  of  inspecting  hardware 
systems  for  failure,  we  have  the  problem  of  detecting 
faults  in  software  systems.  In  today's  world,  the  number 
and  complexity  of  processes  being  controlled  by  computers 
is  growing  rapidly.  As  the  size  and  complexity  of  computer 
programs  increases,  the  probability  that  the  software  will 
function  error-free  is  near  zero.  Thus  it  is  essential  to 
be  able  to  measure  the  probability  that  software  will 
perform  its  intended  function  at  a  specified  time  in  a 
given  environment,  i.e.,  to  measure  software  reliability. 
Failure  of  the  software  to  perform  its  intended  function 
may  be  due  to  many  factors  ranging  from  errors  in  the 
program  code  (bugs)  to  incorrect  specification  of  program 
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requirements.  Goel  (1985)  gives  an  overview  of  many  of  the 
analytical  models  that  have  been  developed  to  measure 
software  reliability,  and  provides  a  critical  analysis  of 
their  underlying  assumptions.  Most  models  make  use  of  the 
number  of  faults  in  the  software  as  a  basis  to  measure 
reliability. 

The  Jelinski-Moranda  (JM)  model  (1972)  is  one  of  the 
first  and  simplest  models  and,  therefore,  probably  most 
used.  It  assumes  the  failure  rate  of  the  software  is 
proportional  to  the  number  of  faults  remaining  in  the 
software  after  a  period  of  testing.  Let  N  be  the  initial 
number  of  unknown  software  faults,  and  t,  be  a  time  between 
discovery  of  the  (i-l)st  and  ith  fault,  i=l,...,N.  Then 
the  failure  rate  is  r(ti)  =  «#)(N-i+l],  where  0  >  0  is  a 
proportionality  constant.  The  model  further  assumes  that 
faults  are  independent  and  equally  likely  to  cause  software 
failures.  It  also  assumes  that  detected  faults  are  removed 
with  certainty  and  no  new  faults  are  created.  Also  the 
occurrence  of  a  fault  is  equivalent  to  the  detection  of  the 
fault.  This  is  analogous  to  the  assumption  of  a  perfect 
inspection  process.  These  "perfect"  assumptions  are  common 
to  most  software  reliability  models;  however,  they  are 
rarely  true  in  practice. 

Goel  and  Okumoto  (1978)  present  an  imperfect  debugging 
model  which  is  an  extension  of  the  JM  model,  where  p  is  the 
probability  that  a  detected  fault  is  corrected.  Then  the 
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failure  rate  at  time  t;  between  the  (i-l)st  and  ith  failure 
is  r(ti)  =  [N-p(i-l)]0.  The  number  of  faults  in  the  system 
is  governed  by  a  semi-Markov  process  with  transition 
probabilities  Qij(t)  =  p[  l-exp(-i0t)  ]  .  Bayesian  prior 
estimates  for  N  and  ep  are  gamma  distributed,  and  for  p  a 
beta  prior  is  used;  see  Dunn  and  Ullman  (1982) . 

The  Shooman  model,  like  the  JM  model  assumes  the 
failure  rate  is  proportional  to  the  number  of  remaining 
faults  in  the  program.  Specifically  r(t)=k[N/I  -  n(T)], 
where  t  is  operating  time  of  the  system,  t  is  debugging 
time  (independent  of  t) ,  N  is  the  initial  number  of  faults, 
I  is  total  number  of  instructions  in  the  program,  n(T)  is 
total  number  of  faults  corrected  during  t  (normalized  by 
I) ,  and  k  is  a  proportionality  constant.  This  model  also 
assumes  perfect  fault  detection  and  correction.  An 
extension  of  this  model  by  Shooman  and  Natarajan  (1977) 
allows  for  the  introduction  of  new  faults  during  the 
correction  process. 

One  of  the  important  applications  of  a  software 
reliability  model  is  in  the  decision  process  to  determine 
when  to  end  the  testing  phase  of  software  development  and 
to  release  the  software  for  operational  use.  Okumoto  and 
Goel  (1980)  present  a  procedure  to  minimize  the  cost  of 
software  in  a  release  time  model.  In  order  to  minimize  the 
entire  life-cycle  cost  of  the  software,  based  on  the  JM 
model,  Bai  and  Yun  (1988)  determine  the  optimum  number,  n. 
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of  errors  that  need  to  be  corrected  before  releasing  a 
software  system  to  the  operational  phase.  The  more  errors 
that  are  corrected  during  the  testing  phase,  the  higher  the 
reliability  and  the  lower  the  operating  cost  of  the 
software.  But  a  prolonged  testing  phase  results  in 
increased  cost  of  the  software.  To  achieve  an  optimum  n, 
the  average  gain  is  used  as  a  criterion.  Bai  and  Yun 
conclude  that  the  results  of  their  model  for  the  optimum 
number  of  errors  to  release  software,  are  approximately  the 
same  as  those  obtained  by  the  Koch  and  Kubat  (1983)  model 
which  determines  the  optimum  time,  T,  to  release  software 
based  on  the  average  gain  function.  Again  as  in  most 
models,  a  basic  assumption  is  made  that  faults  are  detected 
and  corrected  with  certainty,  taking  negligible  time. 

1.7  Software  Fault  Diversity. 

In  addition  to  the  assumption  of  perfect  fault 
detection,  many  software  models,  including  the  JM  model, 
assume  that  each  fault  is  equally  likely  to  cause  a 
software  failure.  But  in  reality  some  faults  are  more 
likely  to  occur  than  others.  Boland,  Proschan,  and  Tong 
(1987)  introduced  a  discrete  software  reliability  model 
based  on  the  multinomial  distribution  and  demonstrated  the 
impact  of  fault  diversity  on  time  to  detection  of  faults. 

If  the  software  initially  contains  N  faults,  then  the 
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initial  state  of  the  system  can  be  described  by  a  vector, 
6.=  {Ox,  02/***^n)»  where  0^  is  the  probability  of  detecting 
fault  i.  It  is  shown  that  the  more  diverse  (in  terms  of 
majorization)  ^  is,  the  longer  it  takes  (stochastically)  to 
eliminate  faults.  The  impact  of  fault  diversity  is  also 
demonstrated  for  models  of  the  Jelinski-Moranda  type,  but 
not  specifically  for  the  Jelinski-Moranda  model. 

1.8  Summary. 

In  this  dissertation  we  analyze  the  impact  of 
imperfect  inspection  on  several  models.  Chapters  2  and  3 
present  Type  I  inspection  error  models.  Chapters  4,  5,  and 
6  present  Type  II  inspection  error  models. 

In  Chapter  2  we  obtain  an  optimal  replacement  age  in 
an  imperfect  inspection  model  and  give  an  example  for  a 
device  with  a  truncated  normal  life  distribution.  We  give 
monotonicity  and  asymptotic  properties  for  the  long-run 
expected  cost  per  unit  of  time.  In  Chapter  3  we  extend  the 
cumulative  damage  model  of  Derman  and  Sacks  (1960)  for  the 
case  in  which  the  probability  of  perfect  inspection  is  less 
than  one. 

Chapter  4  extends  the  Barlow,  Hunter,  and  Proschan 
(1963)  optimal  inspection  sequence  model  to  include  reverse 
rule  two  (RR2)  failure  densities.  Chapter  5  then  extends 
the  Barlow,  Hunter,  and  Proschan  (1963)  model  to  include 
Type  II  error,  and  monotonicity  and  majorization  results 
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are  presented. 

Chapter  6  presents  two  software  fault  detection 
models.  Section  6.2  explores  the  impact  of  imperfect  fault 
detection  on  the  Koch  and  Kubat  (1983)  model.  Section  6.3 
shows  the  effect  of  fault  diversity  of  the  JM  model  and 
shows  how  this  relates  to  imperfect  fault  detection. 


2. 


MODEL  1:  OPTIMAL  REPLACEMENT  AGE 
WITH  TYPE  I  INSPECTION  ERROR 


2.1.  Formulation  of  the  Model;  Derivation  of  Solution. 

Merge,  Proschan,  and  Sethuraman  (1986)  formulate  and 
analyze  a  periodic  inspection  model  with  Type  I  inspection 
error  for  a  system  which  is  subject  to  an  age  replacement 
policy.  We  describe  the  model  and  present  the  results  in 
this  chapter.  A  list  of  basic  symbols  follows. 

X  =  lifelength  with  distribution  F,  F(x)  =  1  -  F(x) . 
k,  2k,  ...  are  scheduled  inspection  times, 
f,  s  f(k)  ,  F,  ^  F(k)  ,  r^  s  f,/F,. 

T  =  replacement  age  (positive  integer  multiple  of  k) . 
c,  =  cost  of  unscheduled  replacement. 

Cj  =  cost  of  scheduled  (age)  replacement  (c,  >  Cj)  . 
qi  =  probability  of  Type  I  inspection  error. 

Pi  =  1  -  qi- 

Y  =  observed  lifelength  of  device  with  lifelength  X. 
(^)  =  long-run  expected  cost  per  unit  of  time. 


A  device  has  lifelength  X  with  distribution  function 
F,  which  is  absolutely  continuous  with  density  f  and 
F(0)=0.  The  device  is  installed  at  time  zero  and  is 
inspected  at  successive  times  k,  2k,  ...  to  determine  if  it 
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is  functioning  or  failed.  We  follow  an  age  replacement 
policy  which  calls  for  the  unit  to  be  replaced  by  a  new 
unit  at  age  T  (which  is  a  positive  integer  multiple  of  k) 
or  at  the  first  inspection  following  failure,  whichever 
comes  first.  Replacement  time  is  assumed  negligible.  When 
an  error  in  inspection  (Type  I)  occurs  (with  probability 
0  <  q,  <  1) ,  a  functioning  unit  is  replaced  by  a  new  unit. 
Define  Pi=l-q, .  On  the  other  hand,  a  failed  unit  is 
replaced  at  inspection  with  probability  one.  This  process 
is  continued  indefinitely.  Clearly  the  process  renews 
itself  at  times  of  replacement. 

It  is  apparent  that  an  age  replacement  policy  is 
inappropriate  if  the  underlying  failure  rate  is  decreasing. 
Thus  we  will  assume  that  the  failure  rate  r (t) =f (t) / [F (t) ] 
is  increasing.  The  probability  that  the  device  survives 
until  time  t=ik  is  P [ Y>ik]=Fj,^pj  for  i=0,l,2,...  in  the 
absence  of  planned  replacement,  since  the  device  must 
survive  to  time  ik  and  pass  i  inspections,  where  Y  is  the 
observed  lifelength  of  the  device.  Let  Z  be  the  elapsed 
time  between  replacements;  then  Z=min{Y,T}.  Note  that 
E(y)=k£F^;  . 

i-O 

Let  c,  be  the  cost  of  an  unscheduled  replacement 
(resulting  from  actual  or  believed  failure)  and  C2  be  the 
cost  of  a  scheduled  (age)  replacement.  Assume  c,  >  Cj. 

Our  objective  is  to  find  the  replacement  age  T  which 


minimizes  Lp{T)  ,  the  long-run  expected  cost  per  unit  of 
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time.  Theorem  2.1  gives  a  formula  for  (T)  and  Theorem 
2.2  describes  the  optimal  value  T*  of  T. 


Theorem  2.1. 


_c,-(c,-C2)f’r.,  Pi 


pi 


Proof .  The  times  of  replacement  are  renewal  times  in  a 
renewal-reward  process  whose  interarrival  distribution  is 
that  of  Z  =  min  {Y,T}.  From  renewal  theory,  we  have  that 
Lp(T)  =  C(T)/D(T),  where  C(T)  is  the  expected  cost  per 

renewal  cycle,  and  D(T)  is  the  expected  duration  of  a 
renewal  cycle.  Denote  the  distribution  function  of  Y  by  G. 
Then  for  i=l, 2 , . .  . 

G(t)  =  P[Y>t]  =  {i-l)k  <  t  <  ik. 
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T-k  and  a  cost  of  Cj  is  incurred.  Otherwise,  it  is 
replaced  at  or  before  time  T-k  and  a  cost  of  c,  is 
incurred.  Therefore  the  expected  cost  per  cycle  is 

T  T 

C(T)  =  c,(l  -  p,'*  ‘)  +  p.'^  \  II 

Theorem  2.2.  In  addition  to  the  assumptions  about  F  given 

above,  assume  that  r  is  differentiable.  Then 

_  m-\  _ 

a .  l'  (T)=  [ k  F^l y^H{T)  ,  where 

(=0 

Tlk-\  _  _ 

H(T)  =  (c.-cj)  [  (kr^.*-ln  p,)  Y  ^  • 

/”0 

b.  An  optimal  replacement  age  T*  exists  (T*  may  be 
infinite),  and  T*=k  «  p,<  exp  (Cj/ (Cj-c,)  +  kro)  . 

c.  T’  is  finite  <=>  r„>c,/ (Cj-Cj)  EY  +  (l/k)ln  p,. 

d.  EY/k  <  Cj/Cj  implies  that  T*  <  ». 

e.  A  lower  bound  for  T*  is  (C2/c,)EY. 

Proof . 

a.  Differentiate. 

b.  Given  c,  >  C2  note  that  H  is  increasing  since  r  is 

_ 

increasing  and  H' (T)  =  {c^-C2)krj.^  Y^n^P''  Then  T*  =  k 

i«0 

Lp^  is  increasing  «  H(k)  >  0 


(C1-C2)  (krfl-ln  Pi  +  1)  -  c,  >  0  ^  Pi  <  exp  (C2/ (C2-C,)  +  kro). 
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If  p,  >  exp(C2/ (C2-C,)  +  kro)  ,  then  H(k)  <  0.  Thus  if  we  can 
find  Tq  =  inin{T:  H(T)>0},  then  is  negative  on  (0,To-k) 

and  positive  on  (To,«)  .  So  we  choose  t’  such  that  L(T’)  = 
inin{L(To-k)  ,L(To)  }  .  Otherwise,  if  there  is  no  T  such  that 
H(T)  >  0,  then  L  is  decreasing  and  T*  =  w;  i.e.,  planned 
replacement  does  not  occur. 

c.  The  inequality  involving  r„  holds  if  and  only  if 
limT^„H(T)  >  0.  Since  H(0)  <  0,  the  equation  Tq  =  min{T: 
H(T)>0}  has  a  finite  solution. 

d.  Note  that  Lp  (T)  <  Lp  {k)  =  c^/k.  If  T*  =  oo,  then 

Lp  {T*)  =  c^lEY  <  Cj/k .  By  the  contrapositive,  EY/k  <  Cj/Cj 
implies  that  T*  <  oo. 

e.  It  is  easy  to  show  that  Lp  {T)  >  c-^/T .  Thus  Lp  (T) 

must  cross  («>)  =  c^fEY  (if  it  crosses  at  all)  to  the  right 

of  the  value  at  which  C2/T  crosses  C|/EY;  this  value  is  T  = 
(C2/Ci)EY.  Therefore,  we  should  schedule  replacement  at  an 
age  greater  than  (c2/c,)EY.  jj 


2.2.  Asymptotic  and  Monotonicitv  Properties  of  Lp^(T). 

If  we  let  Pi=l,  we  get  a  desired  asymptotic  result  for 
L,  (T)  as  the  length  of  the  inspection  interval,  k,  goes  to 
zero.  In  this  case  the  model  reduces  to  the  simple  age 
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replacement  model  for  which  the  optimization  problem  was 
solved  by  Barlow  and  Proschan  (1965),  pp.  85-90.  If  F  is 
Riemann  integrable,  then  since  the  denominator  of  L,  (T)  is 
a  Riemann  sum,  it  converges  to  the  integral  form  given  in 
Barlow  and  Proschan  (1965)  p.  88,  as  follows: 

^ |F(x)d>: 

Next  for  0<p,<l,  we  provide  asymptotic  results  for 
Lp(T)  as  the  length  of  the  inspection  interval,  k,  goes  to 

zero,  and  also  as  k  goes  to  infinity. 

Theorem  2.3.  For  0  <  p,  <  1,  lim  L  (T)  =  oo,  and 

i-O 

lim  L  (T)  =  0. 

*-00 

c  c 

Proof.  Case  1.  For  T  =  k,  (k)  =  —I,  then  lim_?  =  <», 

k  k-o  k 


lim  L.(T)  = 
*-o 


and 


.  cr, 
lim— i 
*-.00  k 


0. 


Case  2.  For  T  =  <»,  (») 


EY 


pI 


then 
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and 


lim - — - 

Pi 


>  lira 
*-0 


OD 

^E  Pi 

1=0 


lim. 

ik-*oo 


k'Zy^p! 

i=0 


lim 


it-*  00 

k{l 


Case  3 .  For  k  <  T  <  <», 


=  lim _ 

<=i 

*-0 

f  % 

1 

k 

1-Pi 

-Ep.p/) 

1=1 


T  =  mk  for  a  positive 


integer  m,  and  L  (mk)  =  P‘ _ ^  then 

ni'“\ 

kY.'^u.  pi 


‘^2)P(m-l)*  Pi  ^  n  ‘^l"  (^1~‘^2)  Pi  _  i  ^  "  (  *^1  ”^2)  Pi 


m-1 


lim 

*-o 


m-l  ^ 
1-0 


>  lim. 

i-O 


»n-! 

*Ep.' 

i»0 


=  lim. 

l:-»0 


=00 , 


i-pr 


i-Pi 


and 


m-I 

(m-iM  Pi 


k~*QO 


m-l  ^ 

^E  Pi 

1=0 


=  lim. 

it-*  00 


m-l 


=  0. 


^(1  ^  E^i^-  Pi) 


1=1 


At  p,  =  1,  lim  L  (T)  is  discontinuous  since 

*-K) 


lim  L.{T) 
*-0 


C2  +  (Cj  C2)Ff 

f 

I  F{x)  dx 


<  00 


while  for  0  <  p,  <  1,  lim  L.  (r)  =  «. 

k-Q 
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Theorem  2.3  shows  that  the  more  frequently  you 
inspect,  the  greater  the  cost  per  unit  of  time.  This 
logically  results  in  the  conclusion  that  it  would  be  best 
not  to  inspect  at  all,  but  simj-l  '  to  perform  a  planned 
replacement  at  time  T.  Ho.  /er,  there  are  situations  in 
which  a  fixed  k  is  reasonable  and  justifiable;  e.g.:  the 
government  requires  that  a  certain  vital  part  of  the 
airplane  (like  the  recorder)  is  inspected  every  k  hours, 
the  fire  alarm  system  in  a  home  or  factory  is  inspected 
every  k  hours,  etc. 

It  is  easily  seen  that  (T)  increases  as  PilO  as 
follows. 

a.  Note  that  <  F*p,;  for  p,„,  <  p,„, 

for  i  =  0,1,..., T/k  -  1.  Thus  for  T  =  k,  2k,  ... 

1/  I  pL)  >  1/  E  . 

(=■0  1=0 

When  T  >  k,  we  have  strict  inequality  above. 

b.  Note  that  for  p,,„  <  p,„  and  T  =k,  2k,  ... 

T.i  _  7-., 

^T-k  Plm  -  ^T-k  Pin 

When  T  >  k  we  have  strict  inequality.  Thus 

_  ^-1 

^l~  ^T-k  Plm  —  Pin 
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From  a.  and  b.  we  have  L  (T)  =  (T)  for  T  =  k  and 

»  U*  r  U 

(T)  for  p,.„  <  p,„  and  T  =  2k,  3k,  ...  . 

This  is  intuitively  reasonable  since  more  mistakes  in 
inspection  leads  to  an  increase  in  unnecessary 
replacements.  This  can  be  seen  in  Figure  2.5  in  the  next 
section.  Clearly  when  p,iO  lim  {T)  =  cjk  =  Lq{T)  ,  thus 

Lo(T)  is  an  upper  bound  for  (T)  for  0  <  p,  <  1. 

Since  Lp  (T)  is  a  decreasing  function  of  p,  (see  Figure 

2.5),  we  obtain  a  sharp  lower  bound  for  L^{T)  by  taking  the 

limit  as  p,  increases  to  one.  Thus 

\{T)>  lim  L,,(r)=  =  L,(T)  . 

1*0 

We  denote  the  optimal  value  of  T  for  a  particular  p, 
as  Tp*  .  Then  the  optimal  long-run  expected  cost  per  unit 

of  time  is  (T^* )  =min  L^_(T)  .  Since  for  all  T  and  p,„<  p,„ 
we  have  L  (T)>  L  (T)  ,  it  follows  that 

r\jm  r  u< 


2.3.  Application  to  the  Exponential  Distribution. 

Our  model  makes  sense  only  for  a  failure  rate  which  is 


20 

increasing.  We  see  from  Theorem  2.1  that  the  denominator 
of  Lp(T)  is  a  sum  which  can  be  explicitly  solved  for  an 

exponential  distribution  F.  Intuitively  it  is  clear  that 
the  optimal  policy  is  to  replace  only  at  failure  times, 
because  replacing  an  exponential  component  by  a  new 
component  does  not  change  the  residual  life.  We  show  that 
Theorem  2.2  confirms  that  T*  =  «>.  Let  F(x)  =  exp(-Xx)  ,  X  > 
00 

0 .  Then  EY  =  i^p^e 
<=o 


)'  =  - — - Setting  l' (T)  =  0  solving 

l-p,e‘^ 


for  T  we  get 


T  =  ;c  +  In 


c,-C2 


In  p,e 


-W: 


l+p,e'^  (-1  +  In  p,e"^) 


In  p,e 


-)Je 


Note  that  1  +  Pi©'^  (-1  +  In  p,e'^)  >  0  since  it  reduces  to 


the  form  In  x  <  x  -1,  which  is  true  for  x  -  Pi''e^  >  !•  Thus 


for  T  to  exist,  we  need 

c, 

implies  r„  =  X  < 


C,-C2 


(l-Pie'^)  +  In  p,e'^  >  0,  which 


+  —In  Pj.  Thus  from  Theorem 


(c,-C2)Fy  k 
2.2.C.  we  see  that  T*  =  w. 


2.4.  Application  to  the  Truncated  Normal  Distribution, 
/'n  application  of  the  model  for  a  truncated  normal 


distribution  was  chosen  so  that  results  can  be  compared  to 
the  asymptotic  case  treated  in  Example  1,  p.90,  of  Barlow 
and  Proschan  (1965) . 
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Example  2.1.  A  certain  tube  used  in  commercial  airline 
communication  equipment  has  a  truncated  normal  failure 
distribution  with  a  mean  life  of  9080  hours  and  a  standard 
deviation  of  3027.  Suppose  Ci=  $1100  and  C2=  $100. 

The  density  f(x)  of  the  truncated  normal  distribution 
may  be  written  as 


f(x) 


0 


X>  0 

a 

otherwise , 


00 

where  <p(x)  =  ^  e and  b  =  —  [<p(^LJi)dx. 


From  L' (T)  =  0  we  get 


7''_  .  _  ^-1 

(A:rj-.*-ln  p,)  P,'  +  F,..*  p,^ 


(2.1) 


i-O 


C,-C2 


Making  the  change  of  variable  u  =(T-k-p)/a,  we  have  from 
(2.1)  for  a  truncated  normal  distribution  F, 


OU*fi 


{^r{u)  -Inp,)  pi  f  <p{v)dv  +  p“^J^(v) 

iX-a  u 


dv 


be, 


c^  Cj 


(2.2) 


Define  K(u)  to  be  the  left  hand  side  of  (2.2). 

If  p/o  >  3,  then  f(x)  is  very  close  to  the  density  of 
a  normal  distribution  with  mean  p  and  standard  deviation  a. 
Thus,  in  Example  1,  Barlow  and  Proschan  estimate  b  by  1  and 
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graphically  estimate  u  to  be  -1.5.  To  obtain  more  accurate 
results  for  comparison  with  our  model,  we  compute  b  =.9987 
and  K(u)  =  1.0986.  Then  u  =  -1.63,  and  the  optimal 
replacement  age  is  4146  hours  with  an  associated  minimum 
cost  of  L(4146)  =  $.036. 

Next  we  observe  the  impact  of  Type  I  inspection  error 
on  this  example.  We  obtain  T*  for  four  cases:  when  the 
length  of  the  inspection  interval  is  k=1000  and  the 
probability  of  no  error  in  inspecting  a  functioning  unit  is 
Pi=.95;  when  k=500  and  p,=  .95;  when  k=1000  and  p,=  .5;  and 
when  k=500  and  p,=  .5.  Note  that  for  the  truncated  normal 
distribution  r<«=  so  we  know  by  Theorem  2.2.c.  that  T*  is 
finite. 

Using  (2.2)  we  will  find  the  value  of  T  such  that 
K(  (T-k-/i) /ct)  is  nearest  to  K(u)  =  bc,/(c,-C2)  =  1.0986. 
Tables  1  through  4  show  the  results  of  these  computations. 
The  corresponding  graphs  of  (T)  are  shown  in  Figures  1 

through  4 . 

We  see  from  Table  1  below  that  T’  =  4000  is  the 
optimal  value,  which  gives  us  the  minimum  cost  L95(T*)  = 
$.0710  as  shown  in  Figure  1.  We  compute  EY  =  7629.  Recall 
from  the  proof  of  Theorem  2.2.e.  that  c,/EY  =  .144  is  the 
horizontal  asymptote  for  (T)  .  Also  (c2/c,)EY  =  694  is  a 


lower  bound  for  T*. 


We  see  from  Table  2  below  that  T*  =  4000  is  the 
optimal  value  and  Lp(T')  =  $.1271  shown  in  Figure  2.  We 

compute  EY  =  5979.  Then  (c2/c,)EY  =  544  is  a  lower  bound 
for  T*.  Notice  in  Figure  2  that  C2/IC  >  c,/EY;  thus  the 
implication  in  Theorem  2.2.d.  cannot  be  reversed. 


Comparing  the  cases  where  k=500  and  k=1000,  it  is 
clear  that  more  frequent  inspections  result  in  a  higher 


optimal  cost  Lp(T‘). 


Table  2.  Values  of  K(u)  for  k=500,  p,=.95 


Figure  2.  Values  of  Lp^iT)  for  k=500,  p,=  .95. 

We  see  from  Table  3  below  that  the  graph  of  K(u)  does 
not  cross  bc,/(Ci-C2)  =  1.0986.  Thus  there  is  no  solution 


to  Lp  {T)  =0,  so  that  >  0,  and  the  cost  is 
increasing,  as  shown  in  Figure  3. 


Table  3.  Values  of  K(u)  for  k=1000. 


T 

u 

K(u) 

1000 

-3.00 

1.6923 

2000 

-2.67 

1.5410 

3000 

-2.34 

1.4710 

4000 

-2.01 

1.4490 

5000 

-1.68 

1.4590 

6000 

-1.35 

1.4969 
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0.55-1 

0.6 -j 

0.46 
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0.16 
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0.06 
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10OO 


2000 


3000 


4000 


5000 


Figure  3.  Values  of  for  k=1000. 


Then  the  minimum  cost  is  $.10  =  L  (1000) 


strictly 

p,=  .  5 


Legand 

C1/E(Y) 

Lp1(T) 


p,=  .5. 

at  T'  =  k 


This  is  expected  from  Theorem  2.2.b.  since  . 5  =  p,  < 
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expCcj/ (Cj-c,) +kro)  =exp(-.l  +  1000  ( .  0C00015) )  «  .9062. 

Since  EY  =  1980,  (Cj/cJEY  =  180  is  a  lower  bound  for  T*. 

As  in  the  previous  case  where  p,=  .5,  we  see  in  Table  4 
below  that  K(u)  does  not  cross  bCi/(c,-C2)  =  1.0986,  so  that 


Table  4.  Values  of  K(u)  for  k=500,  Pi=.5 


T 

U 

K(u) 

T 

u 

K{u) 

500 

-3.00 

1.6915 

3000 

-2.17 

1.4040 

1000 

-2.83 

1.5384 

3500 

-2 . 01 

1.4042 

1500 

-2.67 

1.4630 

4000 

-1.84 

1.4089 

2000 

-2.50 

1.4260 

4500 

-1.68 

1.4164 

2500 

-2.34 

1.4096 

5000 

Dollar*  par  Hour 
1.3i 
1.2- 

1.1-  *  ♦  •>  ♦  '  T  t  T  t 

1  - 
0.9- 
0.8- 
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0.1  -I - . - . - ^ - 1 - . - . - ^ - . - . — 
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Legend 
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Figure  4.  Values  of  Lp^{T)  for  k=500,  Pi=.5. 


cost  is  strictly  increasing  and  T*  =  k  as  expected  from 
Theorem  2.2.b.  since  .5  =  p,  <exp (C2/ (C2-c,)  +  kro)  = 
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exp(-.l  +  500 (. 0000051) )  ~  .9055.  A  lower  bound  for  T*  is 
(Cj/cJEY  =  91. 

We  summarize  the  results  of  these  cases  in  the  Table  5 
which  follows. 


Table  5.  Summary  of  Examples 


Pi 

k 

(C2/C,)EY 

T* 

EY 

1.00 

0 

825 

4146 

9080 

$.036 

.95 

1000 

694 

4000 

7629 

$.071 

in 

• 

500 

544 

4000 

5979 

$.127 

.50 

1000 

180 

1000 

1980 

$.100 

.50 

500 

91 

500 

998 

$.200 

Recall  from  Theorem  2.2.e.  that  (Cj/cJEY  is  a  lower 
bound  for  T*.  It  appears  that  EY  is  an  upper  bound  for  T*. 
Note  that  for  p=.95  and  k=1000,  and  p=.95  and  k=500,  when 
T*<  00  and  T*  k,  we  could  have  used  the  method  in  Example  1 
p.90  of  Barlow  and  Proschan  (1965)  to  compute  the  optimal 
replacement  age,  then  chosen  the  closest  integer  multiple 
of  k  to  get  the  desired  result. 


Next,  to  observe  asymptotic  and  monotonicity 
properties  of  Lp  (T)  ,  for  k=1000,  we  compare  L^  iT)  for 
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values  of  p,  from  .5  to  1.0  in  Figure  5.  For  p,  =  .5,  .7, 
and  .9  vfe  have  T*  =  k  =  1000.  Clearly  Lp(T*)  and  (T)  are 

decreasing  in  Pj.  The  upper  bound  is  Lo(T)=l.l,  and  the 
sharp  lower  bound  is  L,  (T).  Horizontal  asymptotes  are 
labeled  Lp, (inf). 


Figure  5.  Comparison  of  Lp^[T)  for  k=1000. 


3.  MODEL  2:  CUMULATIVE  DAMAGE  ASSESSMENT 
WITH  TYPE  I  INSPECTION  ERROR 

3.1.  Derman  and  Sacks  Model  and  Stopping  Lemma. 

Derinan  and  Sacks  (1960)  considered  the  problem  of 
choosing  an  optimal  replacement  rule  when  the  amount  of 
deterioration  of  the  equipment  can  be  observed  at  each 
inspection  time.  The  criterion  for  evaluating  the 
effectiveness  of  the  replacement  rule  is  based  on  expected 
cost  per  unit  of  time  per  replacement  cycle  instead  of 
long-run  expected  cost  per  unit  of  time.  We  will  summarize 
their  results  and  give  an  extension  that  incorporates  the 
probability  of  a  Type  I  inspection  error. 

Let  Z  be  the  lifelength  of  a  device  with  distribution 
function  G.  Let  c,  be  the  cost  of  replacement  after 
failure  and  Cj  be  the  cost  of  replacement  before  failure. 

At  each  inspection  time  t=l,2,...  we  observe  the  amount  of 
deterioration  X,  which  occurred  during  the  interval 
(t-l,t)  .  Assume  that  {X,}  is  a  sequence  of  i.i.d., 
nonnegative,  random  variables  with  common  distribution 
function  F.  The  equipment  fails  when  the  cumulative  damage 

n 

Sn=  exceeds  a  given  threshold  L. 

/■I 


We  restrict  ourselves  to  the  class  f  of  replacement 


rules  of  the  form  N=min(t',  [Z]+l) ,  where  [Z]  denotes  the 
greatest  integer  less  than  Z,  and  v  is  an  optional  stopping 
rule  based  on  the  cumulative  damage.  We  wish  to  find  a 
rule  N*e  f  which  minimizes  the  average  cost  per  unit  of 
time  per  replacement  cycle.  This  is  accomplished  by  using 
the  following  optimal  optional  stopping  lemma.  For  the 
proof  see  Derman  and  Sacks  (1960) . 

Lemma  3.1.  Let  n=l,2,...}  be  an  increasing  sequence 

of  a-fields  of  a  sample  space  n.  Let  {Y„}  be  a  sequence  of 
random  variables  which  are  measurable,  and  such  that  EY„ 
exists  and  is  finite  for  all  n.  Let  6  be  the  class  of  all 
optional  stopping  rules  such  that  EN  <  <».  If  there  exists 
an  optional  stopping  rule  N*  with 

a.  EN*  <  00, 

b.  E{Y„  <  Y„.,  when  n  <  N*(«) 

>  Y„.,  when  n  >  N*(«) 

for  almost  all  w  e  n;  and  if  there  is  some  M  <  oo  such  that 

c.  for  all  n,  E{|Y„^,-Y„|  |7j  <  M, 

then  EYf..=  min  EYf,.  Thus  N*  is  an  optimal  stopping  rule. 
we« 

3.2.  Application  of  Optimal  Optional  Stopping  Lemma. 

In  order  to  apply  the  lemma  to  the  replacement 


problem,  let 
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y  = 


c^jn  if  n<Z 

c, 

if  n>Z . 


[Z]^l 


Let  N  be  the  number  of  time  periods  until  a  replacement 
under  our  replacement  rule.  Then  we  wish  to  choose  N  to 
minimize  EYn- 

Derman  and  Sacks  show  that  if  we  choose  n*  to  be  the 
smallest  n  such  that 


1-F(L-S„.,)> 


^2 

(c,-C2)  (n-1)  ' 


then  N*=  min(n’-l,  [Z]+l)  is  the  optimal  rule. 


3.3.  Extension  of  the  Model  for  Type  I  Error. 

We  define  qi(S„)  as  the  probability  of  mistakenly 
replacing  a  functioning  unit  after  observing  the  cumulative 
damage  S„,  because  we  conclude  that  the  threshold  has  been 
exceeded  when  actually  it  has  not  been  exceeded.  Since  we 
are  more  likely  to  make  such  a  mistake  as  the  cumulative 
damage  nears  the  threshold  value,  it  makes  sense  for  qi(S„) 
to  be  an  increasing  function  of  n.  Then  p,  (S„)  =l-q,  {S„)  is 
the  probability  of  concluding  that  the  cumulative  damage 
does  not  exceed  the  threshold  when  it  actually  does  not 
exceed  the  threshold.  On  the  other  hand,  a  failed  unit  is 
replaced  at  inspection  with  probability  one. 

Define  W  to  be  the  observed  lifelength  of  the 


equipment  so  that  P[f/  >i]  =  n  Pi  (Sj)  ,  for  i=0, 1, 2,  .  .  . , 


where  p,  (So)=l.  Let 


Cj/n  if  W  >n 

f**!  c  c 


[W] 


since  the  y„  are  uniformly  bounded,  condition  c.  of 
the  lemma  holds.  We  see  that  if  n-1  <  W,  then 


f?  + 

n  n 


[1-F(L-S„.,)], 


and  if  n-1  >  W,  then 
F[yJX,,...,X„.,,p,(S,),...,p.(S„.,) 

I  =  l  y=0 


IW] 


(W] 


Let  be  the  a-field  generated  by 
X], Xp,  P]  ( S| Pi  (S„}.  Then 


<^2-=Y.  if  n-KW  ,  1-F(L-S„.)  <- - -i- - , 

n-1  ^  '  /  V  «  1/  (c.-c,)  (n-1) 


>— 2_=y  .  if  n-KW  ,  i-f(l-s„  ,)  >_ - , 

n-1  /  V  „  1/  (Cj-Cj)  (n-l) 


=y„.,  if  n-l>  W. 


Let  n*  be  as  defined  above.  Then,  for  all  n  >  n',  we 


have  1-F(L-S„.,)  >  C2/ (Cj-Cj)  (n-1)  ,  since  1-F(L-S„.,)  is 
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increasing  in  n  and  Cj/ (0,-02)  (n-1)  is  decreasing  in  n. 
Define  N**  =  min(n*-l,  [W]+l)  .  Then  routine  computation 
shows  that  condition  b.  of  the  lemma  is  satisfied.  Also 
EN**<  1  +  EW  <  00;  thus  condition  a.  is  satisfied.  Similarly 
all  replacement  rules  in  f  have  finite  expectations.  Thus 
N*’  is  the  optimal  rule.  Note  that  N*'  <  N*,  since  there 
will  be  more  frequent  replacements  when  there  is  a  chance 
of  inspection  error. 


4.  MODEL  3:  OPTIMAL  INSPECTION  SCHEDULE 
FOR  A  RRj  DENSITY 

4.1.  Formulation  of  the  Model. 

Barlow,  Hunter,  and  Proschan  (1963)  presented  a  model 
and  algorithm  to  obtain  an  optimum  inspection  schedule  with 
results  based  on  the  assumption  that  the  system  is 
deteriorating,  specifically  that  the  lifelength  density 
function,  f,  is  a  Polya  frequency  function  of  order  2 
(PFj)  .  Before  presenting  the  impact  of  Type  II  inspection 
error  on  this  model  in  Chapter  5,  this  chapter  presents 
results  obtained  under  the  assumption  that  the  system  is 
aging  beneficially,  specifically,  that  the  lifelength 
density  function  f(x-y)  is  reverse  rule  2  (RR2)  • 

Consider  a  system  for  which  the  lifelength  T  has  known 
failure  distribution  F  with  finite  mean  Hj.  Suppose  that 
system  failure  is  discovered  only  by  inspection  and 
possibly  only  after  some  time  has  elapsed  since  failure. 
Assume  that  inspection  takes  negligible  time,  does  not 
degrade  the  system,  and  system  failure  cannot  occur  during 
inspection.  Each  inspection  costs  c,,  so  we  do  not  wish  to 
check  too  often.  On  the  other  hand,  there  is  a  cost  Cj  per 
unit  of  time  elapsed  between  system  failure  and  detection 
of  failure,  so  that  we  wish  to  check  often  enough  to  detect 
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ilure  quickly.  Assume  an  inspection  always  follows 
failure.  Upon  detection  of  failure,  inspection  ends. 

Our  goal  is  to  determine  an  inspection  policy  which 
minimizes  the  total  expected  cost  resulting  from  both 
inspection  and  failure. 

As  shown  in  Chapter  4,  Section  2.4  of  Barlow  and 
Proschan  (1965) ,  any  random  schedule  may  be  improved  upon 
by  a  nonrandom  schedule.  Thus  define  a  checking  procedure 
by  an  increasing  sequence  of  nonnegative  numbers 

where  Xo=0  and  the  support  of  F  is  equal  to  [0,lim  )  . 

n  00 

For  k=l,2,...,  the  kth  check  is  performed  at  time  if  the 
system  has  not  failed  by  the  (k-l)st  check.  If  the  system 


fails  at  time  t,  where  <  t  <  ,  then  the  total  cost 

incurred  is  c,(k  +  l)  +  C2(x^,,-t)  .  Hence  the  expected  cost  is 


03  *•' 

Jfe-O  J 
■*1 
oo 

=  ]CCc,(k  +  l)  +  C2  x^.,3  [F(x^.,) -F(x^)  ]  -  C2  Mr- 

k‘0 


(4.1) 


When  F  is  a  continuous  life  distribution  with  a  finite 
mean,  then  an  optimum  checking  schedule  must  exist,  as 
proven  in  Barlow,  Hunter,  and  Proschan  (1963).  Next  they 
show  how  the  optimum  checking  schedule  may  be  obtained  if 
the  failure  density,  f(x),  is  PF2.  We  will  present 
analogous  results  when  f(x-y)  is  RR2.  For  convenience,  the 
results  from  Barlow,  Proschan,  and  Hunter  (1963)  are  stated 
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here  first  without  proofs. 

4.2.  Results  for  a  PF-,  Density. 

From  Barlow  and  Proschan  (1981)  p.  76,  we  have  the 
following  definition  for  a  Polya  frequency  function  of 
order  2. 

Definition  4.1.  A  function  h(x),  -»  <  x  <  oo,  is  PFj  if 
(a)  h(x)  >  0  for  -«  <  x  <  «,  and 

h(Xi-yi)  h{x^-y^) 

h{x^-y^)  h(.x^-y^) 

for  all  -Qo  <  X,  <  Xj  <  «  and  -“o  <  Yi  <  y2  <  Equivalently, 
(b')  In  h(x)  is  convex  on  (-«>,«>),  or 
(b")  for  fixed  A  >  0,  h(x+A)/h(x)  is  nonincreasing  in 

X  for  a  <  X  <  b,  where  a  =  inf  y,b  =  sup  y. 

h(y)>0  h(y)>0 

Thus  it  can  be  seen  from  Definition  4.1  that  log- 
concave  functions  and  PFj  functions  are  the  same.  We 
define  a  "strictly  PFj"  function  by  using  a  strict 
inequality,  >,  in  Definition  4.1  (b) . 

Assuming  a  failure  density  f,  a  necessary  condition 
that  a  sequence  {x^}  be  a  minimum-cost  checking  procedure 
is  that  3C/3X|j  =  C  ‘"or  all  k.  Hence  using  (4.1),  we  obtain 
for  k=l, 2 , . . . , 
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F{x,)  -F(x,  ) 

*  ^  /(Xj) 


(4.2) 


When  f(x^)=0,  x^^.,-Xi,=oo;  thus  no  more  checks  are  scheduled. 
The  sequence  is  determined  recursively  once  we  choose  x, . 
The  optimum  checking  policy  is  denoted  {x,^}. 


Theorem  4.1.  If  the  failure  density  f  is  PFj,  and  f(x)  >  0 
for  X  >  0,  the  optimum  checking  intervals  are 
nonincreasing . 

Theorem  4.2.  Let  f  be  strictly  PF2  with  f  (x)  >  0  for  x  >  0 
If  X,  >  xj,  then  <S„  >  <S„.,  for  some  positive  integer  n.  If  x, 
<  xj,  then  <  0  for  some  positive  integer  n. 

Algorithm  4.1. 

1.  To  balance  the  cost  of  a  single  check  against  the 
expected  cost  of  undetected  failure  occurring  before  the 
first  check,  choose  x,  to  satisfy: 

F{t)dt. 

2.  Compute  Xj/Xj,...  from  (4.2). 

3.  If  5^  >  reduce  x,  and  repeat.  If  <  0, 

increase  x,  and  repeat. 


c,  =  C2r(x,-t)dF(t)  =  Cj 


Intuitively  these  results  are  not  surprising.  Since  a 
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PF2  density  has  an  increasing  failure  rate  distribution 
(IFR) ,  we  need  to  check  more  and  more  often  as  the  system 
failure  rate  increases.  Similarly,  we  will  show  that  we 
need  to  check  less  and  less  frequently  if  the  system 
failure  rate  decreases.  Specifically,  we  will  show  that 
optimum  checking  intervals  are  nondecreasing  if  the  failure 
density  f(x-y)  is  RRj.  Then  we  will  present  a  procedure  to 
derive  the  optimum  schedule.  Finally  note  the  decreasing 
failure  rate  (DFR)  Weibull,  gamma,  and  exponential 
distributions  all  satisfy  these  conditions;  thus  for  these 
distributions,  nondecreasing  checking  intervals  are 
optimal. 

4.3.  Results  for  a  RR;,  Density. 

From  Karlin  (1968)  p.  12,  we  have  the  following 
definition  for  a  function  which  is  reverse  rule  of  order  2. 

Definition  4.2.  Let  A  and  B  be  subsets  of  the  real  line. 

A  function  K(x,y)  on  AxB  is  said  to  be  reverse  rule  of 
order  2  (RR2)  if 

K{x,,y,)  K{.x^,y^) 

^  0 

Kix^.y^)  K{x2,y2) 

for  all  X,  <  Xj  in  A  and  y,  <  yj  in  B. 

We  are  interested  in  the  special  case  K(x,y)  =  h(x-y). 

From  the  above  definition,  it  is  easy  to  verify  for  a  RR^ 
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function  h(x-y) ,  that  h(x)  is  log-convex.  In  other  words, 
by  reversing  the  inequality  in  Definition  4.1  (b)  we  obtain 
the  definition  of  a  log-convex  function.  If  strict 
inequality,  <,  holds,  then  we  have  a  "strictly  log-convex" 
function. 

Note  that  a  log-convex  function  is  not  necessarily  a 
density  function.  But  if  a  density  function  f  is  log- 
convex  with  support  on  [0,oo),  then  the  corresponding 
distribution  F  is  DFR.  The  proof  is  analogous  to  that  for 
corresponding  conditions  on  a  PFj  density  in  Barlow  and 
Proschan  (1981)  p.77. 

Part  (b)  of  the  definition  gives  us  a  very  simple  way 
to  show  when  the  Weibull  and  gamma  distributions  are  DFR. 
The  following  example  is  exercise  10  on  page  79  in  Barlow 
and  Proschan  (1981) . 

Example  4.1.  Let  g  be  the  gamma  density: 

g(t;X,a)  =  — - — exp(-Xt)  for  t>0,  X>0,  a>0. 

r(a) 

Then  In  g(t;X,a)  =  ln[X“/r(a)]  +  (a-l)ln  t  -Xt. 
Differentiating  twice  we  get 

j  2 

——  In  g(t;X,a)  =  -(a-l)f^  >  0  for  0<a<l 
dt^ 

<  0  for  a>l. 

Thus  g  is  log-convex  and  G  is  DFR  for  0<a<l,  while  g  is  PF2 
(log-concave)  and  G  is  IFR  for  a>l. 
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We  need  the  following  lemmas  to  prove  that  optimal 
checking  intervals  are  nondecreasing. 

Lemma  4.1.  A  density  f  is  log-convex  if  and  only  if,  for 
all  A,  [F(x+A) -F(x) ] /f (x)  is  nondecreasing  in  x. 

The  proof  is  analogous  to  that  of  Theorem  1,  Appendix  1  of 
Barlow,  Hunter,  and  Proschan  (1963)  where  f  is  PFj. 

Equivalent  to  Lemma  4.1,  a  density  f  is  log-convex  if 
and  only  if  for  all  A>0,  [F(x+A) -F(x) ] /f (x)  is 
nondecreasing  in  x,  and  for  all  A>0,  [F(x) -F(x-A) ] /f (x)  is 
nonincreasing  in  x. 

Lemma  4.2.  If  f  is  log-convex,  where  x  <  y,  a  >  1,  and 

^  F(^x)  -F(x-aA) 

fWi 


A  >  0,  then. 


F(y) -F(y-A) 

fiy) 


The  proof  is  analogous  to  the  proof  of  Theorem  3 ,  Appendix 
1  of  Barlow,  Hunter,  and  Proschan  (1963)  where  f  is  PFj. 

Theorem  4.3.  If  the  failure  density  f  is  log-convex,  and 
f(x)  >  0  for  X  >  0,  then  optimum  checking  intervals  are 
nondecreasing . 


Proof.  Let  {Xfc}  denote  the  optimum  checking  policy  and  {x^} 
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another  checking  policy  obtained  from  (4.2).  Assume  for 
some  k  and  a  >  1  that  ^n/<Sk.2  =l/a<l.  We  will  show  that 
this  implies  <  l/a. 

Note  that 


3  (S.  ”  s 

1.  t  =  a 

~F  F(Xjj.2) 

Jk-1  ^ 

f  (Xt) 

L  J 

The  right  hand  side  is  negative  by  Lemma  4.2  and  the 
assumption  that  a<J^.,  =  Hence  afij^.j  <  S^.,2  implies  that  a5|j 

<  <Sn.  Thus  we  conclude  that  if  for  any  k,  5^  <  then 

-►  0  geometrically  fast  from  some  point  on  as  n  <». 

Next  we  show  Si  <  <5^.,  for  some  k  contradicts  the  fact 
{x^}  is  an  optimum  policy.  Notice  x’+,  is  the  optimum  first 
checking  point  for  the  conditional  density  f  (t+x*) /F (x*)  . 
Expected  cost  for  the  optimum  first  check  is  then, 


Cl  +  f  (Jfn*l-t)  =  C,  +  Cjf 


(Vt)£l£:^ 

F{X„  ) 


since  iS„  0  as  n  ->  <».  This  is  a  contradiction  because  the 
expected  cost  for  the  optimum  first  check  using  the  density 
f (t+x*) /F(x’)  is  greater  than  c,  as  follows  since  f'  <  0: 


2C, 

J-  F(x,  ) 


1^":-  i  {Xn\l-t)dt  >  C 

Fix:)  J. 


Hence  optimum  checking  intervals  are  nondecreasing.  | 
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Now  since  the  exponential  density  is  both  log-concave 
and  log-convex,  applying  Theorems  4.1  and  4.3  we  obtain  the 
following  result,  which  is  stated  without  proof  in  Barlow, 
Proschan,  and  Hunter  (1963) . 

Corollary  4.1.  If  f(x)  =  Xexp(-Xx) ,  x  >  0,  X  >  0,  then 
optimum  checking  intervals  are  a  constant  5;  =  m,  where  m 
is  the  unique  solution  of  exp(Xm)  -  1  =  X(c,/c2  +  m)  . 

To  obtain  an  algorithm  for  computing  an  optimum 
checking  sequence  when  f  is  log-convex  we  need  the 
following  lemma. 

Lemma  4.3.  Assume  f  is  log-convex.  Let  {x^}  be  generated 
by  (4.2)  with  >  0  for  k=l,2,...,N  where  ~ 


Then 


dx,  ~  f  (,x^)  dx, 


The  proof  is  by  induction,  analogous  to  the  proof  of  Lemma 
1  in  Barlow,  Hunter,  and  Proschan  (1963) . 

Theorem  4.4.  Let  f  be  strictly  log-convex  with  f(x)  >  0 
for  X  >  0.  If  Xj  <  x^,  then  <  0  for  some  positive 
integer  n. 
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The  proof  is  analogous  to  the  proof  of  Theorem  6  in  Barlow, 
Hunter,  and  Proschan  (1963) . 

Algorithm  4.2. 

1.  Choose  X,  as  in  Algorithm  4.1. 

2.  Compute  Xj,  Xj, . . .  recursively  from  (4.2). 

3.  If  any  <S,j<  0,  increase  Xj  and  repeat  above.  If 
<  5|j.,  for  some  k,  reduce  x,  and  repeat  above. 

4.  Repeat  to  desired  level  of  accuracy. 

Example  4.2.  Suppose  the  time  to  failure  has  a  Weibull 
density  f(t)  =  aX“t"‘exp[-(Xt)“]  with  a=.5,  X=.l,  c,=10,  and 
0^=1.  Thus  f  is  DFR  with  a  mean  life  of  20  and  cost  per 
inspection  is  10  times  the  cost  per  unit  of  time  for 
undetected  failure.  By  step  1  we  estimate  Xi=17.676  which 
gives  us  all  S^^  >  0.  The  next  estimate  Xi=8  results  in  6^  < 
0.  Repeating  step  3  eventually  yields  8.546  <  xj  <  8.547. 
Checking  intervals  obtained  for  x, =17. 676,  x,=8,  and 
x,=8.547  are  contained  in  Tables  6  and  7  below. 

Using  (4.1)  to  compute  the  optimum  cost  we  get 
C=27.746  when  x|=8.547.  To  see  the  impact  on  cost  if  we  do 
not  follow  the  optimum  sequence,  suppose  we  just  change 
X2=26.663  to  X2=20.  Then  the  cost  computed  from  (4.1)  is 
28.314.  The  cost  obtained  by  using  the  sequence  starting 
with  x, =17. 676  through  Xj=9 . 957x10“**  is  C=45.764. 
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Table  6.  Optimum  Checking  Sequences;  X|=17.676,  X|=8.000 


k 

^Ic 

Xk 

5k 

1 

17 . 676 

63.899 

8 . 000 

15.866 

2 

81.575 

195.793 

23 .866 

18.313 

3 

1.340x10^ 

1.058x10’ 

42 . 179 

17 .250 

4 

1.250X10’ 

1.242x10’ 

59.429 

12.828 

5 

9.957x10'*’ 

9.957x10*’ 

72.258 

5.289 

6 

9.957x10'*’ 

0 

77.547 

-4.348 

Table  7. 


Optimum  Checking  Sequence 


for  x,=8.547 


■■ 

Xk 

5k 

k 

Xk 

5k 

1 

8 . 547 

18 . 116 

16 

593 . 556 

55.552 

2 

26,663 

23 . 660 

17 

649 . 108 

58.091 

3 

50,323 

27.740 

18 

707.199 

61.149 

4 

78.063 

31.041 

19 

768.348 

64.973 

5 

109.105 

33.853 

20 

833 . 321 

69.926 

6 

142.958 

36.328 

21 

903.247 

76.564 

7 

179.286 

38.558 

22 

979.811 

85.779 

8 

217.845 

40.606 

23 

1.07x10’ 

99.089 

9 

258.451 

42 . 519 

24 

1.17x10’ 

119.249 

10 

300.970 

44 . 335 

25 

1.28x10’ 

151.883 

11 

345.305 

46.090 

26 

1.43x10’ 

210.089 

12 

391.395 

47.823 

27 

1 . 65xl0’ 

331.771 

13 

439.218 

49 . 576 

28 

1.98x10’ 

674.578 

14 

489.794 

51.400 

29 

2 . 65x10’ 

2 . 67x10’ 

15 

540.194 

53.362 

30 

5 .32x10’ 

4 . 09xl0’ 

Next  in  Chapter  5,  we  modify  the  model  by  introducing 


the  possibility  of  a  Type  II  inspection  error 


5.  MODEL  4:  OPTIMAL  INSPECTION  SCHEDULE 
WITH  TYPE  II  INSPECTION  ERROR 

5.1.  Formulation  of  the  Model. 

Consider  a  system  for  which  the  lifelength  T  has  known 
failure  distribution  F  with  finite  mean  n-j-.  Model  4  is 
identical  to  Model  3  in  the  last  chapter  except  that  now  we 
let  P2  <  1  be  the  probability  that  failure  is  detected  upon 
inspection  and  qj  =  1  -  P2  be  the  probability  that  we  fail 
to  detect  a  system  failure  at  an  inspection.  If  the  system 
fails  at  time  t,  where  <  t  <  x,(+,,  then  the  probability 
the  failure  is  detected  at  time  x^+j  is  P2q2'‘>  and  the  cost 
incurred  is  then  c,(k+i)  +  C2(X|j+i-t)  .  Hence  the  expected 
cost  is 

00  00 

=  IIP2<?rX  f  ^  ]dF(t) 

(5.1) 

00  c  ” 

=-<^2^^T  ^  E  [^i^^-7^^c'2x;p2grV.]  ]  • 

*•0  P2  1-1 

5.2.  Existence  of  an  Optima]  Solution. 

The  proof  of  the  existence  of  an  optimal  checking 
sequence  follows  the  proof  for  P2=l  in  Barlow,  Hunter,  and 
Proschan  (1963)  with  some  modifications.  Given  that  a 
failure  is  detected  at  the  jth  inspection  following  failure 
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with  probability  P2=l  the  expected  cost  is 


oo  «*• 

S  =  E  f 

*=0  J 


C,{X,,j-t)  ]dF(t)  . 


It  can  be  shown  that  an  upper  bound  for  the  expected 
cost  is  Cjj  +  2yC|C2aJ  ,  following  the  proof  of  Lemma, 

p.1080,  Barlow,  Hunter,  and  Proschan  (1963). 

Next  we  can  show  that  Lj(x)  ,  the  infimum  of  expected 
cost  over  all  policies  given  that  failure  is  detected  at 
the  jth  inspection  and  given  that  the  component  is  of 
initial  age  x,  is  continuous.  The  proof  follows  the  proof 
of  Theorem  1,  p.  1081,  Barlow,  Hunter,  and  Proschan  (1963) . 
Then  the  infimum  of  expected  cost  over  all  policies,  Pj  < 

1,  given  the  component  is  of  initial  age  x  is 

i-n  (^)  =  tp2^2'Lj{X)  . 

2  =  1 

<»  .  . 

By  the  Weierstrass  M-test,  Y.Pi'ji'  converges 

7  =  1 

uniformly  to  (x)  ,  and  since  each  P2<?2 (-Jf)  is  continuous, 

then  is  continuous.  The  remainder  of  the  proof 

follows  the  proof  of  Theorem  1,  p.  1081,  Barlow,  Hunter, 
and  Proschan  (1963) . 

A  necessary  condition  for  a  sequence  {x^}  to  be  a 
minimum  cost  checking  procedure  is  that  dC^/dx^  =  0  for  all 

k.  Hence  using  (5.1),  we  obtain 
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~  ^k‘>l  ^k 
k 

where  N,^  = 

1  =  1 


^k  ^2^k*l  —  ' 

C-2 

[F{x,)-F{x..,)  ]g*-‘ 
f{x,) 


(5.2) 


The  sequence  is  determined  recursively  once  we  choose  x,. 


5.3.  Schedule  for  Systems  with  Finite  Lifelenath. 

Realistically,  no  system  lives  forever  without  repair 
or  replacement.  If  it  is  known  that  a  system  lifelength 
must  be  less  than  T  <  oo,  we  can  give  necessary  and 
sufficient  conditions  on  the  failure  distribution  F  to 
ensure  that  an  optimal  checking  policy  consists  of  a  single 
check  at  time  T.  Maintaining  the  same  assumptions  as  given 
in  the  previous  model,  we  assume  a  check  always  follows  a 
failure. 


Theorem  5.1.  Let  F(t)=l  for  t  >  T.  If 


Fit) 


Pi 


1  +  _i (T-t) 


(5.3) 


for  0  <  t  <  T,  then  the  optimum  policy  consists  of  a  single 
check  at  time  T.  Conversely,  if 


Fit) 


>  _ 

1 

Pi 

1  +  _i (T-t) 
^1 

(5.4) 


for  some  0  <  t  <  T,  then  the  optimum  policy  will  require  in 


addition  to  the  check  at  time  T  one  or  more  checks  before 
time  T. 


Proof.  If  a  single  check  is  performed  at  time  T,  the 
expected  cost  is 


D,  =  c,  +  C2|(T-t)dF(t) 


T 

c,  +  c.^^{t)dt. 


If  an  additional  check  is  performed  at  time  x,  then 
the  expected  cost  is 

X  X 

D2W  =  P2j‘[c,+C2(x-t)  ]dF(t)+ 

T 


|[2c,+c2(r-t)  ]dF(t) 


+  jC2c,-t-C2(T-t)  ]dF(t)  . 


Thus  a  single  check  at  time  T  is  preferable  if  for  all 
0  <  X  <  r,  D^ix)  -  D,  >  0  ;  or  equivalently, 

D^{x)-D^  =  c,[l-p2F(x)  ]  -  C2(T-x)P2F(x)  >  0, 
which  gives  us  (5.3). 

Now  assuming  a  single  check  at  T  is  preferred  to 
checks  at  x  and  T,  we  show  that  a  single  check  at  T  is 
preferable  to  a  check  at  time  T  preceded  by  two  checks  at, 
say,  times  x,  and  Xj.  Define  x^=  {x^,  .  .  .  ,Xy)  .  Let  D3(X2)  be 
the  cost  of  checking  at  times  x,,  x^,  and  T.  Given  that  a 
check  has  occurred  at  time  x,,  a  single  check  before  T, 
namely  at  time  Xj,  is  warranted  if  and  only  if  D3(X2)  “02(x,) 
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<  0,  or  equivalently, 

-D^ix^)  =c^{l-p^F{Xj)  -p^q^F(Xi)  ]-c^p^{T-x^)  [F{x^)  -p2F{x^)  ]<  0. 


This  gives  us 

Fix^)-  P2F{x^)  ^  1 

1-  p^Fix^)  p^[1+{T-x^)C2/c^] 

for  some  Xj  <  Xj  <  T.  But  the  above  implies 
F{x^)>  l/p2^1+(T-x^)c^/c^]  since 

ll-pjF(Xi)  ]F(X2)>  Fix^) -p2Fix^)  .  But  this  contradicts  our 
assumption  that  F(x)<  l/P2[l+(^^“-X’)  c^/Cj]  for  0  <  x  <  T . 

Similarly  it  is  easy  to  show  that  (5.3)  implies  a 
single  check  at  time  T  is  preferable  to  k  checks  before  T 
at  times  x, ,  Xj,  ...  x^.  The  expected  cost  of  performing 
k+1  checks  at  times  x,,  X2,  .../  X|^,  T  is 

c,(l-M,,,)-  C2P2(T-x,)  [F(x,)-MJ 

**i  (5. 

where  M,=0 ,  P2'^  F  (x^_,)  g^’’  for  k=2 ,2  ,  .  .  . 

i=: 

Given  that  checks  have  occurred  at  times  x,,  Xj,  ..., 
Xu,  an  additional  check  at  some  time  Xj^,  where  x*.,<  x^<  T , 

is  warranted  if  and  only  if  0^+,  (x,^) -D^ (x^.,)  <  0,  or 
equivalently, 

F(xJ-M*^  1 

1-  p^Cl  +  CT-xJc^/c,]  ' 
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But  the  above  inequality  and  the  fact  that  F(X|j.,)  >  Mj.  imply 

Fix^)-  F{x^.^)  ^  1 

1-  F(x*.,)  P2[l+(r-xJC2/c,]  ' 

which  in  turn  implies  F(x^)>  l/p2[l+(T-xJ  Cj/c, ]  , 

contradicting  our  initial  assumption  that  a  single  check  at 
T  is  preferred.  Conversely  if  (5.3)  is  not  true  for  some  x 
in  [0,T],  then  checks  at  times  x  and  T  will  yield  a  lower 
expected  cost  than  does  a  single  check  at  T.  Thus  the 
optimum  checking  policy  will  require  one  or  more  checks 
before  T.  || 

Inequality  (5.4)  suggests  that  we  would  prefer  to 
conduct  more  checks  than  just  a  single  check  at  T  if  the 
cost  per  inspection,  c,,  is  sufficiently  small  compared  to 
the  cost  of  failure,  Cj,  or  if  the  probability  of  detecting 
a  failure,  P2,  is  sufficiently  large. 

We  can  compute  a  checking  sequence,  x,,  X2,  ...,  x„=T 
and  the  expected  cost,  Dn(2^.,)  ,  recursively  from  (5.2)  and 
(5.5)  once  we  have  chosen  x, .  If  our  choice  of  x,  is 
greater  than  the  unknown  optimal  value  x|,  then  the 
checking  sequence  computed  from  (5.2)  will  not  contain  an 
inspection  time  Xn=T,  but  rather  will  contain  an  x„ 
exceeding  T  for  some  n.  On  the  other  hand  if  our  choice  of 
X,  is  less  than  the  optimal  x|,  the  checking  sequence 
computed  from  (5.2)  will  have  x^  <  T  for  all  k,  and  for 
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some  n  we  will  obtain  x„^.,  <  x„.  A  reasonable  first  guess 
for  Xi  would  be  the  same  as  in  Algorithm  4 . 1  where  we 
balance  the  expected  cost  of  a  failure  occurring  before  x, 
against  the  cost  of  a  single  inspection  at  x, . 

Example  5.1.  Suppose  it  is  known  that  a  system  will  not 
function  after  time  T=10.  Assume  the  life  distribution  of 
the  system  can  be  represented  by  an  exponential 
distribution  truncated  at  T=10  with  parameters  X=.l  and 
cost  factors  c,=l  and  C2=10.  Then 

10 

f(x)  =  .  le‘ i*  for  0<x<10 

0 

=  .  (1-e-')  . 

Let  the  probability  of  failure  detection  be  P2=.9.  Our 
first  guess  for  x,  is  1.146  which  is  too  large.  A  second 
guess  of  Xi=1.0  is  too  small.  Continuing  to  choose  values 
for  X,  halfway  between  a  value  which  is  too  small  and  a 
value  which  is  too  large,  we  can  obtain  an  optimal  value 
for  Xj  to  whatever  degree  of  accuracy  is  required  to  make 
the  sequence  end  at  T=10.  The  sequences  obtained  using 
Xi=1.146,  x,=1.0,  and  Xi=1.0933  and  their  associated  costs 
are  given  in  Table  8  on  the  next  page. 

Using  Theorem  5.1  we  can  show  when  P2=-9  and  x, =1.093  30 
that  17  inspections  are  preferred  to  16,  but  18  inspections 
are  not  preferred  to  17.  So  the  optimal  checking  schedule 
requires  17  inspections,  resulting  in  an  expected  cost  of 
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Table  8.  Checking  Schedules  {xj  and  Costs  {DjCx)}  for  a 


Truncated  Exponential 

II 

• 

H 

►9 

-10 ,  C|  1 , 

C2=10,  for 

P2=.9 

B 

Xi 

Di 

X. 

D. 

Di 

B 

1.146 

59.198 

1.000 

59.198 

1 . 09330 

59.198 

2 

2 . 142 

46.394 

1.852 

47.868 

2 . 03695 

46.917 

3 

3.109 

36.435 

2 . 661 

38.937 

2 . 94612 

37.314 

B 

4 . 044 

28 . 790 

3 .423 

31.960 

3  81743 

29 . 889 

5 

4.944 

23 . 017 

4 . 134 

26.563 

4 . 64732 

24.223 

6 

5.805 

18.744 

4.790 

22.435 

5 .43207 

19.967 

B 

6.624 

15.664 

5.387 

19.317 

6 . 16783 

16.829 

8 

7.397 

13.517 

5.921 

16.995 

6.85067 

14.568 

9 

8.120 

12.091 

6.389 

15.295 

7.47663 

12.984 

10 

8.789 

11.210 

6.787 

14 . 075 

8 . 04179 

11.913 

11 

9.400 

10.730 

7 . 112 

8 . 54233 

11.222 

12 

9.949 

10.532 

7.361 

- 1 

12 . 660 

8 . 97461 

10.803 

13 

10.432 

10.522 

7.532 

12.314 

9.33526 

io.5;o 

14 

10,846 

10.523 

7.623 

12 . 144 

9 . 62127 

10.457 

15 

7 . 633 

12 . 124 

9.83006 

10.413 

16 

7.561 

12 . 246 

9 .95956 

10.402 

17 

7 .407 

12 . 520 

10.00828 

10.40197 

10.40197  versus  tne  cost  of  59.198  if  only  a  single 
inspection  is  performed  at  T=10.  Under  the  optimal 
schedule  for  P2=l,  we  obtain  x, =1.0859344  and  only  15 
inspections  are  required  with  an  expected  cost  of  9.436. 
Thus  when  P2<1  our  initial  inspection  time,  x,  =  1.09330,  is 
later  than  when  P2=l/  x,=l . Or 59344 .  But  we  must  inspect 
more  frequently  when  P2<1,  resulting  in  a  higher  expected 
cost.  The  optimal  inspection  schedule  and  cost  when  P2=l 
are  given  in  Table  9  on  the  next  page. 


when  0  <  <  1 . 

Due  to  the  memoryless  property  of  the  exponential 
distribution,  one  would  expect  optimal  checking  intervals 
to  be  constant.  But  Sengupta  (1982)  showed  that  the  first 
checking  interval  is  longer,  solving  the  problem  as  a 
continuous-time  Markov  decision  process.  Denote  the  first 
checking  interval  by  5o=>^i  and  set  5,=m  for  i=l,2,...,  then 
we  can  solve  for  m  from  equation  (5.1)  and  3c^/3x,  =  0  and 


dCp/dx^  =  0.  Let  F(t)  =  1  -  exp(-Xt)  ;  then 


\m  =  -ln(g2+ 

.  r  lx" 

Xx.  =  ln  1+  -1  +  m  —  . 


(5.6) 


Solving  for  m,  we  get 
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\m  =  In 


+  m  + 


Pi 

T 


-  In 


Pi 

W2-pr  ^  <?2^  + 

'-2 


T 


(5.7) 


Thus  our  optimal  chec)cing  sequence  is  x^,  x^+m,  x^+2m,  ... 
and  the  expected  cost  is 


C  =  --f  +  C2(x,-7n)  +  (c,+C2m)  — 
A  P>y 


• 

JL  + 

Pi 

e^-1 

(5.8) 


Example  5.2.  Let  F  be  an  exponential  distribution  with 
X=.01.  Assume  the  probability  of  detecting  failure  at 
inspection  is  p2=.9,  the  cost  per  unit  of  time  for 
undetected  failure  is  C2=l  and  the  cost  per  inspection  is 
c,=10.  Then  using  (5.6)  and  (5.7)  we  obtain  x, =41. 874  and 
m=36.805.  The  expected  cost  from  (5.8)  is  =  57.075. 

Table  10  below  compares  results  for  different  values 
of  Pj  when  X=.01,  c,=10,  and  C2=l.  Thus  the  smaller  the 
probability  of  detecting  a  failure,  the  longer  we  wait  to 
perform  the  first  inspection,  but  then  the  remaining 
inspection  intervals  i—m  are  shorter  for  smaller  P2.  This 
reflects  the  lack  of  confidence  in  the  ability  to  detect  a 
failure,  and  as  P2  decreases,  the  expected  cost 

increases.  These  relationships  are  verified  by  finding  the 
derivative  with  respect  to  P2  of  ,  x,,  and  m. 
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Table  10.  Optimal  Schedules  and  Costs 
for  an  Exponential  Density  X=.01,  C|=10,  C2=l 


P2 

m 

Cp2 

1.0 

41.622 

41.622 

51.622 

.9 

41.874 

36.805 

57.075 

.8 

42.630 

32 . 526 

63 .262 

.7 

43.936 

28 . 619 

70.487 

.6 

45.913 

24 . 961 

79 . 220 

.5 

48.799 

21.452 

90.251 

.4 

53.056 

17.995 

105.048 

.3 

59.663 

14 .480 

126.781 

.2 

71.141 

10.737 

164 . 091 

.  1 

97.138 

6.416 

254 . 881 

5.5.  Optimal  Checking  Intervals  for  a  PF^  Density 
when  0  <  Pt  <  1. 

For  P2=l,  it  is  proven  in  Theorem  5,  p.  1088  of 
Barlow,  Hunter,  and  Proschan  (1963)  that  optimal  checking 
intervals  are  nonincreasing  if  the  failure  density  f  is 
PF^. 

For  0  <  P2  <  1,  the  same  conclusion,  that  optimal 
intervals  are  nonincreasing,  is  proven  here  when  the 
failure  density  is  PF2.  Parmigiani  (1990d)  formulated  a 
model  incorporating  both  Type  I  and  Type  II  inspection 
errors.  A  Type  I  error  occurs  when  an  inspector  mistakenly 
says  that  a  system  has  failed  when  it  is  in  fact 
functioning.  A  Type  II  error  occurs  when  an  inspection 
fails  to  detect  a  malfunctioning  system.  Parmigiani 
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(1990d)  found  that  the  problem  of  minimizing  the  long-run 
expected  cost  depends  on  the  probability  of  a  Type  I  error 
only  as  a  function  of  the  constant  cost  factors.  Thus  for 
simplicity  of  notation,  we  will  use  our  Model  4,  which  uses 
only  Type  II  error.  First  we  present  monotonicity 
properties  of  the  model  in  Section  5.5.1.  In  Section 

5.5.2,  we  prove  that  when  the  failure  density  is  PF2, 
optimal  inspection  intervals  are  nonincreasing.  In  Section 

5.5.3,  we  obtain  an  algorithm  for  computing  optimal 
intervals.  Finally,  we  derive  majorization  results  for  an 
optimal  inspection  policy  in  Section  5.5.4. 

Recall  that  in  Model  4  a  system  has  lifelength  T  with 
known  failure  distribution  F  with  finite  mean  Mt-  The 
probability  of  detecting  the  failure  of  the  system  upon 
inspection  is  a  constant  P2.  We  denoted  a  sequence  of 
inspection  times  by  {x,;}  for  k=0,l,...  and  Xq^O.  Failure  of 
the  system  can  only  be  detected  at  one  of  these  inspection 
times.  Let  S  be  the  time  when  failure  is  detected.  Then 
P(S=  Xj  =P{X|^_^<S  <Xf.) 

k-l 

1-0 

*-l 

Fix,)]. 

1-0 

Denote  the  failure  distribution  of  S  by  G.  Then 

t  j-\ 

Gix,)=  P(S<  xj=  EE^2<5r'2'‘'‘[J"(^,..)-  ]• 

J"]  (*0 


(5.10) 
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5.5.1  Monotonicitv  Properties. 

It  is  reasonable  to  conjecture  that  as  the  probability 
of  detecting  a  failure  decreases,  then  the  expected  time  to 
detect  the  failure  will  increase.  We  show  that  the 
expected  time  of  failure  detection,  is  a  decreasing 
function  of  pj  as  follows. 

00  oo 

=  E(S)  =  -F(x,)  ]  . 

X=0  i=I 

.  00  00 

=  E  E  ^  ]  ^2"  ( 1  -P2i )  • 

“P2  k-O  1=1 

By  definition  +  .  ^  5^,,..,. 

Let  S=  max  <S,.  Then  x,.-  <  x,.  +  iS„,. 

k£  *+i-l 

Applying  this  to  d/Xs/dPa  we  get 


dPz 


1=1 


x=o 


*=0 


P2 


<  0. 


By  a  similar  proof  we  can  show  that  is  a  decreasing 

function  of  P2.  Again  it  is  reasonable  that  the  long-run 
expected  cost  would  decrease  as  the  expected  time  to  detect 
the  failure  decreases. 

Another  way  to  view  the  impact  of  imperfect  inspection 
on  the  long-run  expected  cost  is  that,  increases  as 
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the  difference  between  the  expected  time  to  failure- 
detection,  and  the  expected  time  to  failure,  fij, 
increases.  This  can  be  seen  by  writing 

“  c 

*>0  P2 


5.5.2.  Optimal  Intervals  are  Nonincreasinq  for  a  PF, 
Failure  Density. 

When  P2=l,  Barlow,  Hunter,  and  Proschan  (1963)  proved 
intervals  are  nonincreasing  for  a  PF2  density.  The  proof 
by  contradiction  showed  that  if  inspection  intervals  began 
increasing  at  some  point  in  time,  then  they  continued  to 
increase  geometrically,  resulting  in  the  expected  cost  also 
increasing  to  infinity.  But  when  0  <  P2  <  l,  an  increase 
in  inspection  intervals  at  some  point  in  time  does  not 
result  in  intervals  increasing  to  infinity.  However,  we 
will  prove  here  that  the  intervals  between  expected 
detection  times,  conditional  on  time  of  failure,  increase 
geometrically  and  this  is  sufficient  to  provide  the  proof 
by  contradiction. 

Given  an  inspection  sequence  {xj,  the  expected  time 
of  detection  of  failure,  S,  conditioned  on  the  time  of 
failure,  T,  occurring  in  an  particular  interval  is 

00 

T  <  Xf_)  =  P2^2^k*i  k-1 , 2  ,  . 

i=0 


(5.11) 
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The  inspection  times,  x,j,  and  the  conditional,  expected 
detection  times,  z^,  are  related  by  =  P2X^  +  q2^k+ii 
equivalently, 

(5.12) 

Pi  Pi 


The  optimal  inspection  sequence  {x^^}  minimizes  the  expected 
cost  function  (5.1)  which  by  applying  (5.11)  can  be  written 
as  follows 

oo 

=  -^ll^T  +  E  ^  ^  ]  •  (5-13) 

*-o  Pi 


Furthermore  applying  (5.12)  to  the  optimal  inspection 
intervals  5^  in  (5,2)  we  obtain  optimal  intervals  between 
conditional,  expected  detection  times  for  k  =  1,2,... 


7t  =  Zk.r  z,  =  Ep2<?2 


[F(x,)-F(x,.,)  ] 


(5.14) 


Iteratively  substituting  the  kth  condition  in  the  (k+l)st 
gives 

(5.15) 

E 

Then  from  (5.12)  and  (5.14)  we  can  write 


F(x,) 

f(Xi) 


and  for  k=2 , 3  ,  . 


F(xJ-F(x*.,)  f(Xj.,) 

- 


Ik  =  Pl^k  +  ‘?27*.i 


k  =  l , 2 ,  ,  ,  . 


(5.16) 
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To  prove  that  optimal  inspection  intervals,  5,^,  are 
nonincreasing  for  a  PFj  density,  we  need  the  following 
facts  and  lemmas.  We  assume  that  f  is  PF2  and  f'  exists 
everywhere.  Let  m  denote  the  mode  of  f  which  is  unigue  by 
Barlow  and  Proschan  (1965)  p.230. 

Clearly  when  f  is  a  PFj  density  and  f'  exists 
everywhere,  then  f^(x)  >  f'(x)F(x).  As  a  consequence,  we 
have 

f'(x)  >  0  =»  f(x)/f^(x)  >F(x)/f{x) 
f'{x)  <  0  =>  f(x)/f'{x)  <F{x)/f{x). 

Furthermore,  we  know  when  f  is  a  Pr’2  density  and  £' 
exists  everywhere,  if  x  <  y,  then  f'(x)/f(x)  >  f'(y)/f(y). 
As  a  consequence  of  this  fact,  if  x,  <  X2  <  m  (mode  of  f) , 
or  m  <  Xj  <  X2  then,  f(X2)/f'(x2)  >  f  (x,) /f '  (x,)  .  The 
inequality  is  reversed  when  x,  <  m  and  X2  >  m. 

Lemma  5.1.  Let  {x,j}  be  an  inspection  sequence  generated  by 
(5.2).  Then  fk/fk.i  >  q2  for  k=2,3,...  . 

Proof.  By  definition 


Then 


Thus  fk/fn  >  q]  if  and  only  if 
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Q 

A  ^<72  [^*-P2^*-I--P2<72''i=’,]  >  g|  [Pt-l-P2^i-2--P292’^Pl] 

^2 


+  ^  >  (g|+  P2q2)Fk-r  <72^i  =  ?2  • 

‘-2 

The  last  inequality  holds  since  the  LHS  is  positive  and  the 
RHS  is  negative.  || 

Using  (5.15)  and  (5.16)  we  can  write  7|(  as  a  function 
of  Xk  and  as  follows: 


=  u(x,,  (S,.,)  ,  ;c  >  1. 


Lemma  5.2.  At  the  optimum,  if  x,^  <  m  (the  mode  of  f)  , 
then  71-  <  7n,  for  k  >  1. 

Proof.  Using  the  notation  F,;  =  F(Xk)  and  f,;  =  f(X|(),  from 
(5.17)  we  have 


For  x,t  <  m,  clearly  F^  -  F^.,  <  fk<5k.i/  thus 


if  and  only  if  5*., 
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Proof.  7^+1  -  7k  =  -  u(Xk,<Jk.i)*  The  result  follows 

when  we  show  3u/3x^  >  0  and  >  0.  For  k=l,  Sq  =  x, 

and  7,  =  P2F,/fi  -  C1/C2.  From  Barlow,  Proschan,  and  Hunter 
(1963)  p.1087,  F(x)/f(x)  is  increasing  in  x  for  a  PF2 
density;  thus  3u/5x,  =  dn/dS^  >  0.  Next  we  prove  the 
results  for  k  >  1. 

From  Barlow  and  Proschan  (1965)  p.  229,  for  fixed  5k-, » 
[F(Xk) -F(Xk-5k.,)  ] /f  (Xk)  and  f  (Xk-5k.i) /f  (Xk)  are  nondecreasing 
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in  for  a  PF2  density  f.  Thus  the  denominator  of  u  is 
nonincreasing  in  Xj,  and  the  numerator  of  u  is 
nondecreasing,  hence  ^u/Sx^  >  0. 

To  show  >  0  we  must  consider  whether  x,^.i  is 

greater  than  the  mode  of  f  or  not.  In  the  first  case 
assume  f'(x^.,)  <  0.  Taking  the  partial  derivative. 


du 


_ ^2 _ 

[fr 

[P2(^*--F’*-l)  +92A-l(p2Vl  +  -5l"-^-^*^  [<?2-f/-l3 
_  ‘'2  ^2 _ 

[fr 


Simplifying  we  get 


du  f/  ^2 


au  _  P2\-^  ^  f/ 

frqlfk-x 


(5.18) 


A-<?2A-. 


The  denominator  is  positive  by  Lemma  5.1,  and  by  assumption 
f'n  <  0,  thus 


du  ^  q2)fk-i  > 

fk-  qUk-x 


(5.19) 


For  the  second  case  assume  f'^.j  >  0.  From  (5.18) 
3u/5(Sn  >  0  if  and  only  if 

P2(l+g2)-ft-i^  g2f/-,[P2<S*.,  +  -^+  g2U(X^,5,.,)  ]  . 

‘'2 

Using  (5.16),  the  above  inequality  is  equivalent  to 

P2(l^  ^2)  ^  ^  q2^1k-x^  • 

fk-x  ^2 
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By  Lemma  5.2,  7n  <  7i,  k  >  1.  Since  f  is  PFj  and  t'  exists 
everywhere,  we  have  fn/fn'  >  fi/f/  >  F,/f,.  Then  applying 
(5.15)  we  get 


<72P2-^  <  P292-^  <  P2(1^92) 

r  -  ^  t 


Therefore  3u/95n  >0.  | 


Let  yo  be  such  that  f"(y)  >  0  for  y  >  yo  >  m,  (the  mode 
of  f )  .  Such  yo  exists  since  f(y)  >  0  for  y  >  0. 


Lemma  5.4.  At  the  optimum,  for  a  >  1  and  x,^.,  >  yo, 
=  a(Sn  implies  >  ay^.,  k  >  1. 


Proof.  From  Lemma  5.3,  3u/35,j.,  >  0  and  dn/Oxy,  >0.  We  will 
prove  that  9^u/95^.,  >  0  then  the  desired  conclusion  obtains 
from 

Tit.i=u  =u  (x^.,i , a5,.,)  >u  (X,., a5^.,)  >au  (x,,  5,.,)  =ay,. 

To  prove  >  0,  write 

where 


v(Xk>^k-i)  =  Pi 


F(x,)-F(x,-5,.,) 


^2 


and 


f  (x,-5,.,) 
f  (^k) 


Then  taking  partial  derivatives. 
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d^U  _  av  ^  f;  ^  ^  JJ.  , 

^\^kt°k-u  ^-Tc - 3"? —  --  ^  ^{^k!  ^k-l)  ' 


dsu  dsU  dsU 


3<Si.i  ^5*.,  5^2  J 


Since  1  -  w(Xk,5n)  is  positive  by  Lemma  5.1,  u(Xk,(S^.,)  is 
positive  by  assumption,  and  d\x/dS^._^  is  positive  by  the 
previous  Lemma,  it  is  sufficient  to  show  that  d^v/dS\_^  >  0, 
d\i/b8\.^  >  0  and  aw/a<S,j.,  >  0.  Now  by  assumption 


^■2(3  2P2) 


dsl 

Likewise,  as  required, 

dw  _  2^' i^k-^k-i) 

~Ss^i  ^  f(x,) 

■5^  ' 

thus  completing  the  proof.  || 


>  0. 


Next  we  present  the  theorem  which  proves  that  if  the 
failure  density  is  PFj  then  optimum  inspection  intervals 
are  nonincreasing. 

Theorem  5.2.  Let  f  be  a  PFj  failure  density  with  f' 
existing  everywhere.  At  the  optimum,  5;,,  >  5;  for  i  >  1. 

Proof .  If  (Si.j  >  a5i  for  i  >  1,  then  7i.j  >  a7i  for  i  >  2, 
since  from  (5.11)  and  (5.16)  we  have 

00 

7m-  37,-  =  EP2<J2(Vi~  • 

;-o 

Consequently,  if  7j  >  a7i.,  for  some  i,  then  there  is  a 


(5.20) 
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positive  integer  k  such  that 

Suppose  for  a  contradiction  that  6^  >  5;,,.  By  Lemma 
5.3,  (Jj  >  5;.,  implies  7;^.,  >  7.  Hence  from  (5.20)  for  some  j 

>  i,  (Sj  >  (Sj_, .  Thus,  for  some  j,  5^  =  acSj.,  with  a  >  1  and  Xj.j 

>  Yo  where  is  such  that  f "  (y)  >  0  for  y  >  Yo  >  m.  It 
then  follows  from  Lemma  5.4  that  7^+,  >  a7j.  From  (5.16) 

7>.i-  ^yj  =  P2(^j.r  ^  <72  (7, .2-  a7,.i)  , 

hence  either  y^+2  ^37j+i  <^^  <^j+i  >  hut,  from  Lemma  5.4, 

the  latter  also  implies  that  ^  37j  +  i*  Consequently  7; 
increases  at  least  geometrically  resulting  in  lim|^„7i  =  <*• 
Next  we  show  that  limi^„7j  =  <»  contradicts  the  fact 
that  {x^}  is  an  optimum  policy.  Note  that  x'+,  is  the  first 
optimum  checking  point  for  the  conditional  density 
f  (t+x*) /F  (X*)  .  Let  m(x*)  denote  the  mean  of  this 
conditional  density,  which  is  finite  by  Barlow,  Hunter,  and 
Proschan  (1963)  p.l089.  Hence  the  expected  cost  for  the 
optimum  first  check  using  the  conditional  density  is 
bounded  above  uniformly  in  n.  But  this  cost  is 


P2 


.  i=0 


-  3  .  cj 


P2 


C. 

P2 

C. 


i  +  cJ  (Y„  +  z„-x„-t) = — ^ 

F(xJ 


-  <^2  -p  since  Y„ 
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which  gives  the  desired  contradiction.  || 

5.5.3.  Computation  of  Optimal  Intervals. 

The  next  theorem  allows  us  to  obtain  an  algorithm  to 
compute  an  optimum  inspection  sequence;  it  requires  the 
following  lemma. 


Lemma  5.5.  At  the  optimum,  d7i.,/dx,  >  0  and  dXj/dx,  >  0  for 
i  >  1.  Moreover,  if  Xj.,  >  m,  then 


dx,  dx, 


for  i>j 


where  rj  =  min 

os  n<  k 


(1^  ‘?2)-^(X,.„-,)  ]  ^  ^ 

*  f  (XjJ  +  q^f  j 


Proof.  We  prove  the  first  part  of  the  lemma,  d7i.,/dx,  >  0 

and  dXj/dx,  >  0  for  i  >  1,  by  induction. 

Since  f  is  PFj,  the  ratio  F(y)/f(y)  is  nondecreasing 

in  y  so  that  at  the  optimum,  dyi/dx,  >  0.  For  i  >  2, 

dy.  ^  ^  dx.  ^  Jy^  d5,.,  ^  , 

dx,  dx-  dx,  dx, 


Moreover,  d5i.,/dx,  =  dx,/dx,  -dx,.,/dx,  and  from  (5.16), 

dx,  1  d7,., 


d7,  ^  P2  [dx,., 
dx,  dx. 


dx,  P2  dx. 


Equating  the  above  to  (5.21)  and  solving  for  dx./dx,  we  get 
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At  the  optimum  7;  =  u(Xi,  <?;.,)/  from  Lemma  5.3  372/6x2  >  0  and 

672/ 3 (Si  >  0.  Hence  dxj/dx,  >  0. 

Next  we  assume  dXi.,/dx,  >  0  and  d7i,2/dx,  >0.  If 

d(Si.2/dXi  >  0,  then  by  (5.21)  d7i.i/dx,  >  0;  if  instead 

diSj.j/dXi  <  0,  then  by  (5.16)  d7i.,/dXi  >  0  again.  Also  by 

(5.22)  dXj/dx,  >  0.  Hence,  by  induction,  for  i  >  1, 

d7j.,/dXi  >  0  and  dXj/dx,  >  0. 

To  prove  the  second  part  of  the  lemma,  let  Xj.,  >  m 

(mode  of  f)  and  i  >  j.  First  assume  d(Sj.|/dx,  >  0.  From 

Lemma  5.3  37j/3Xj  >  0,  and  from  the  first  part  of  this  lemma 

dXj/dx,  >  0.  Applying  this  to  (5.21)  we  have 

^7;  ^  ^yj  ^  ^7y  ^  67^.  dSj., 

dx^  dXj  dx^  35^..,  dXi  “  3(5^.,  dx^ 

From  (5.19)  in  Lemma  5.3 

djj  ^  du  ^  P2(l^  g2)^(^y-i) 

f  (Xj)  -  qjf  {Xj.^) 

Then 

>  P2(l^  ?2)-^(^y-i)  ^7y-i 

^•^1  f  iXj)  -  qU 

By  (5.16) 

_£7y  ^  P2(l+  g2)-^(^y-l)  1  ^7;-l  _  g2  ^7y  ' 

*^^1  f  {Xj)  -  qjf  (x-_^)  P2  P2^^\ 
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Rearranging,  we  get 


f22  > 

dx. 


(1+  q2)f{Xj_^) 


f(Xj)  + 


d>r, 


Hence  it  follows  that 


d7. 


dx. 


n 

n«0 


(1^  g2)^(^>.„-i) 


^7;-i 


dx, 


Let  t]  =  min 
os 


in  [ 


By  assumption  Xj.,  >  m  implies  f  (Xj+„.,) /f  (Xj+„)  >  1  for  n>0, 
which  in  turn  implies  tj  >  l.  Then 

dx,  ^  dx, 


Now  let  i-1  =  j+k  and  we  obtain  the  desired  result  assuming 
d5j/dXj  >  0. 

Next  assume  d5j/dx,  <  0.  Then  from  (5.16) 

0  > 

dx,  pj  dx,  Pj  dx,  ' 

,  dji  1  d7,  , 

Rearranging  we  get  — 1  > - JZl . 

dx,  q^  dx, 


Hence  it  follows  that 


^7>.x- 

dx, 


,*♦1 


^7y-i 

dx. 
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By  Lemma  5.1,  for  n  >  0,  —  >  _ ^2)  (^y»n-i )  which 

<?2  f  (XjJ  +  q^f 

implies  l/q,  >  17,  thus  . 

dx,  dXj 

Again  let  i-l  =j+k  to  obtain  the  desired  result.  || 

Theorem  5.3.  Let  x*  be  the  optimal  first  inspection,  and 
{Xj}  be  the  schedule  obtained  by  (5.2)  from  an  arbitrary 
initial  x,.  Then: 

a.  if  X,  >  xJ  there  is  an  i  such  that  5j  >  5;.,; 

b.  if  X,  <  x|  there  is  an  i  such  that  S,  <  0. 

Proof.  Let  m  be  the  mode  of  f  and  j  be  such  that  Xj.i  >  m. 

From  Lemma  5.5,  d7i.,/dx,  >0,  i  >  1,  and 

I  yfhere  rj  >  1, 

dx,  dx, 

for  all  i  >  j.  Therefore,  an  increase  in  x,  from  x|  will 
result  in  an  increase  in  7j.,  and  7;.,.  The  latter,  by  Lemma 
5.5,  can  be  made  arbitrarily  large  by  appropriately 
choosing  i.  Therefore,  for  some  i,  y,  >  Ji,  which,  from 
(5.20)  implies  that  >  5,+,^  for  some  k.  Likewise  a 
decrease  in  Xj  from  x[  will  eventually  result  in  a  negative 
7i  entailing  a  negative  jj 
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As  a  result  of  Theorem  5.3,  the  optimal  solution  is 
unique.  An  optimum  checking  sequence  can  be  obtained  from 
(5.2)  recursively  once  the  first  inspection  time  x,  is 
obtained,  and  the  bisection  algorithm  to  find  the  optimum 
X,  suggested  by  Barlow,  Hunter,  and  Proschan  (1963)  for  P2=l 
can  be  extended  to  the  case  for  0  <  P2  <  1.  If  the  choice 
of  Xi  is  too  small,  then  eventually  the  checking  intervals 
generated  by  (5.2)  will  be  negative.  If  x,  is  too  large, 
then  checking  intervals  will  eventually  increase,  and  thus 
are  not  optimal. 

Alternatively  an  optimum  sequence  can  be  obtained  from 

(5.12)  and  (5.15).  Suppose  a  starting  x,  is  fixed.  Then 

using  (5.12)  and  (5.15)  we  obtain  Zj  from 

F(Xi)  c, 
z.  =  at,  +  ■  -  — !-  . 

/(X,)  P2C2 

Using  (5.12)  again  we  obtain  z,  from  Zj  and  x, .  Then  the 
following  steps  can  be  repeated: 

1.  When  the  values  of  Z;,  Z;., ,  and  Xj.,  are  known,  use 
(5.12)  to  express  the  right  hand  side  of  (5.15)  as  a 
function  of  X;.,,  Zj,  and  Zj..,,  and  then  solve  for  Zj^,. 

2.  Compute  X;  using  (5.12). 

Then  to  obtain  the  optimum  inspection  sequence  {x*}  we 
apply  the  following  algorithm. 

Algorithm  5.1. 

1.  Compute  {xJ  and  {z,,}  as  above. 
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2.  If  for  some  k,  7^  >  7,^.,,  reduce  x,  and  repeat;  if 
7k  <  0,  increase  x,  and  repeat. 

3.  Continue  until  {x^}  is  determined  to  degree  of 
accuracy  required. 

In  this  way  both  {x^}  and  {z^}  can  be  determined.  also 
at  each  iteration,  (5.13)  can  be  used  to  compute  the  terms 
of  Cpj,  the  expected  cost. 

Example  5.3.  Let  f  be  a  Weibull  density  with  a=2 ,  X=.01 
where  f  (t)  =  Xa  (Xt)  “■'exp[  -  (Xt) . 

Choose  an  inspection  cost  of  Ci=10  and  failure  cost  of  C2=l. 
Table  11  shows  optimal  first  checking  times,  xj,  and 
expected  costs,  Cp2,  for  various  failure-detection 
probabilities,  p2. 

Table  11.  Optimal  First  Checking  Times  and  Costs 


P2 

Cp2 

xi 

1.0 

42 .227 

68 . 15750 

.9 

46.237 

68 . 87350 

.  8 

50.789 

70.02767 

.7 

56.104 

71.69260 

Table  12  below  gives  the  optimal  checking  schedules 
{X*}  and  inspection  intervals  {5*}  for  P2=1.0,  .9,  .8,  and 
.7.  As  P2  decreases,  the  first  checking  time  is  delayed 
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Table  12.  Optimal  Checking  Schedules  for  a  Weibull  Density 
with  X=.01,  ol=2,  c,=10,  C2=1,  P2=1.0,  .9,  .8,  and  .7 


P2=.9 


P2=.7 


22 . 016 


20.077 


18 . 651 


17.538 


16.634 


15.879 


15.235 


14.677 


14.186 


17.937 


16.375 


15.215 


14 . 304 


13.562 


12.940 


12.408 


11.945 


11.538 
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longer,  but  subsequent  intervals  are  shorter. 


Example  5.4.  For  a  skewed  left  Weibull  density,  as  Pj 
increases  the  first  checking  time  is  delayed  longer  as  seen 
in  this  example.  Let  f  be  a  Weibull  density  with  a=5, 
X=.20,  c,=l,  and  01=250.  The  optimal  Xj  is  1.106  at  P2=.25 
and  1.388  at  P2=.50. 


5.5.4.  Maiorization  Results  for  Finite  Inspection 
Sequences. 

Next  we  will  show  that  for  a  fixed  k  <  w  inspection 
sequences  {Xj^}  generated  by  (5.2)  are  related  by  weak 
majorization.  To  simplify  notation  we  will  use  F,t  s  F(x^) 
and  s  f(x^).  Also  from  (5.2)  an  equivalent  form  for 
is 


it -I 


it-1 

-  P2E^*-.g2 


Also  we  will  show  the  long-run  expected  cost  function,  , 

is  an  order  preserving  function.  An  interesting 
consequence  is  that  a  minimum  cost  finite  checking  sequence 
is  not  obtained  by  truncating  an  optimum  infinite  sequence. 
Some  definitions  and  theorems  on  majorization  from  Marshall 
and  Olkin  (1979)  are  repeated  here  for  convenience.  For  x  e 
R“,  X(i)  denotes  the  increasing  order  of  components  of  x. 
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i.e.  X(,)  <  X(2)  <  <  X(„,  and  x,ij  denotes  the  decreasing  order, 

i.e.,  X[,]  >  Xpj  >  •••  >  X(„j. 

Definition  5.1.  For  x,y  e  R", 

X  is  weakly  submajorized  by  y,  denoted 

k  k 

X  y  if  52 1^=1/  •  •  •  ,n,and  x  is  weakly 

1  I 

supermajorized  by  y,  denoted 

k  k 

X  y  if  52  ^(0  ^  E  y© '  ^=1 ,  .  .  .  ,  n . 

1  1 

In  either  case  x  is  said  to  be  weakly  majorized  by  y 
or  y  weakly  majorizes  x.  One  simple  consequence  of  the 
definition,  from  p.ll  of  Marshall  and  Olkin  (1979),  is  that 
X;  <  yj  for  i=l,  •  •  •  ,n  x  Y  ^^d  y  x. 

We  will  show  that  this  is  the  case  for  inspection  sequences 
generated  by  (5.2).  The  proof  is  by  induction,  and 

requires  the  following  lemma. 


Lemma  5.6.  Let  f  be  a  PF2  density  and  f'  exist  everywhere; 
then  for  k=l, 2 , . . . 


BN, 

~^k 


k-\ 


P2E 


>  0. 
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Proof ,  Case  1;  If  x^.  <  mode  of  f,  then  f^  >  0  and 
Then 


Case  2:  If  >  mode  of  f,  then  f^  <  0  and  it 


suffices  to  show  that  >  P252  •  Clearly 


<  P2P,-lE<?r‘  =  P2n-.-7T^  "  ^ 

i-l  1-1  V-*- 


Therefore  F,  >  F*.,  >  P2E  • 


Theorem  5.4.  Let  {Xn}  and  {y„}  be  two  inspection  sequences 
generated  by  (5.2).  Let  x  and  y  in  be  the  first  k+1 
inspection  times  for  these  sequences.  When  f  is  a  PF2 
density  and  P2=l,  or  when  f  is  an  exponential  density  and 
0  <  P2  <  1,  then  Xi  <  yi  implies  x  “^w  Y- 


Proof.  The  proof  is  by  induction.  For  n=l, 


By  implicit  differentiation  we  find 
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dXj 

dXj 


dN. 

1  +  + 


dx, 


P2<?2- 


1  + 


dN^ 

'dx. 


which  is  positive  by  Lemma  5.6.  Thus  X2  increases  when  x, 
increases. 


f,  ^  ^  _  5^2 


Furthermore  dx2/dx,  >  1  when  P2g2— -  +  -5—  ^  ‘7275—  •  This 

f 'i  dXt  dx-> 


is  true  by  Lemma  5.6  when  P2=l  (q2=0)  .  Combining  this 
condition  with  the  definition  of  5,  we  get  the  equivalent 
condition 


f,  fi 

P2g2  ‘  P2  >  _ 

■‘■2  ^2 


5,  +  . 


which  is  clearly  satisfied  for  an  exponential  density  since 
LHS  >  0  and  RHS  <  0.  Now  since  5,  =  X2  -  x,,  we  have 
dS^  _  dX2 


dx,  dx^ 


-  1  >  0. 


Next  we  will  show  d(S2/dX|  >  0  and  dxj/dx,  >  1. 
By  definition 

I  -^3  ~P2^2  ~^2^2^\ 


e  —  ^2  P2P1 

S2  =  X3-X2  =  -  g2 


F(X2)  -p2F{X2-6^) 

fix.) 


<?2 


^3 


F(X2  +  52)  -P2.P’(^2)  -P2?2-f’(^2-<^|) 


f  (X2  +  52) 


dS^  _  dSj  d<s,  dSj  ^^2 

dx,  dX|  dx2  dx, 


Then  we  can  find  d52/dx,  by 
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First  we  find 

dS, 


2-f, 

P2^-<J2~ 

■‘■2  ■‘■3 

M7 

1  ^  ^2-^ 


since  the  numerator  is  positive  by  Lemma  5.1  and  the 
denominator  is  positive  by  Lemma  5.6. 


Next  we  find 


aw,  aw,  f,  2  -fi 

a 5,  ^ 


1  +  g,. 


The  denominator  is  positive  by  Lemma  5.6.  The  numerator  is 


positive  when 


f.  2  dN.  Bn, 

*  si  -  ^^si' 


which  is  true  by  Lemma  5.6  when  P2=l  (q2=0)  . 
An  equivalent  condition  is 


A  2-fi  -fs  f  c.l  rF,-p,F,l  fi  fi 

P2?2-^  +  P2^2-^  *  P2^  ^2^-^  ^  ^  -r"-r 

X,  X,  X3  C,  ±2  ■‘■2  ■‘-3 


which  is  clearly  satisfied  for  an  exponential  density. 
Therefore  d^j/dXj  >  0  and  Xj  =  Xj  +  5i  +  S2  gives 
dx,  dS.  dSj 

us  — =  1  +  >1.  So  an  increase  in  x,  results  in 

dx,  dx,  dx, 


increases  in  both  X2  and  Xj. 

Now  assume  d5„.,/dx,  >  0  and  dx„/dxi  >  1  for  n=2,...,k. 


To  show  d5^/dx,  >  0  and  dX|(^.,/dx,  >1.  By  definition 


<S 


k 


^  ^k-l)  P2^2P(^k  ^k-\  ^ k-2^  "'  P2^2  P^^k  ^k-l  "' 

F(xj 


-  92 


F{Xk-^Sk)  -P2F(xJ  -p^q^F{x,-S^^,)  -  -P2g2'‘-F(x,-<5,.i-  -d),) 

/(x,+<SJ 


Then  we  can  find  d^j^/dXi  from 


dSk  ^ 

] 

f  55,  1 

^^k-2 

^  ^  +  ...  -f 

las.l 

d(S, 

*  + 

[w.i 

dx, 

dXj 

dx, 

d  5,.2 

dx, 

d5, 

dx. 

dx. 

dx, 

First  we  find  for  j=l , 2 , . . . , (k-1) 


dSk 


P2 


1  _  ^2  1 
f  f 


*-l 


•  v 


1  +  g2 


dW,,. 

dx, 


>  0 


*♦1 


since  the  numerator  is  positive  by  Lemma  5.1  and  the 
denominator  is  positive  by  Lemma  5.6.  Next  we  find 


dS, 

~^k 


dNk 

dx. 


rr  . 


i.l  -^k^l 


1+92 


The  denominator  is  positive  by  Lemma  5.6.  The  numerator  is 
positive  when 


P292E  “f — ' 

1  =  1  -^**1  ^^k  ^^k*\ 


which  is  true  by  Lemma  5.6  when  P2=l  (^2=*^)  •  equivalent 


condition  is 


p,>- 

1-1  -‘■*♦1 


C| 

5^  +  — 


f'k 

fk 


£U 

^k*l 


which  is  clearly  satisfied  by  an  exponential  density. 

Thus  dSy./dXy.  >  0,  and  therefore  d^^^/dx,  >  0. 

Also  x^+,=  X,  +  5,  +  (Sj  +  •••  +  S^.  implies 

dx,.*,  d<S,  d(S,  dS, 

*■**  =  1  +  1  +  i  +  ...  +  i  >  1 . 

dx,  dx,  dx,  dx, 


Thus  an  increase  in  x,  results  in  increases  in  Xj,  ...,Xk+,. 
Therefore  x,  <  y,  implies  X;  <  y-,  for  i=l ,  2 ,  .  .  . ,  k+1  and  we 
have  X  y.  || 


To  show  that  ,  the  long-run  expected  cost  function 

preserves  the  ordering  of  weak  ma jorization,  we  need  the 
following  theorem  of  Ostrowski  from  Marshall  and  Olkin 
(1979)  p.  59. 

Theorem  (Ostrowski,  1952).  Let  0  be  a  real-valued 
function,  defined  and  continuous  on  and  continuously 
differentiable  on  the  interior  of  where  ^={x:  x,<...<x„}. 
Then 

0(x)  <  0(y)  whenever  x  y  on  ^  if  and  only  if 
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i.e.,  the  gradient  V0(z)  e  for  all  z  in  the  interior  of 

Similarly, 

0(x)  <  0(y)  whenever  x  <'*'  y  on  ^  if  and  only  if 

0  a  ^  (2)  >  ^  (Z)  >  -  >  (2) 

for  all  z  in  the  interior  of 

Theorem  5.5.  Let  x  and  y  in  R"  be  inspection  schedules 
generated  by  (5.2).  If  x,  <  y,  then  Cp  {x)  <  Cp  {Y_)  ,  when  the 

conditions  of  Theorem  5.4  are  satisfied. 


Proof.  For  any  inspection  sequence  x  generated  by  (5.2)  we 
have  dCpIdXf  =  0  for  i=l,2,...,n.  By  Theorem  5.4  we  have 

X  Y.I  and  applying  Ostrowski's  Theorem,  Cp  (x)  <  Cp  {y_)  .  1| 


A  practical  application  of  Theorems  5.4  and  5.5 
involves  choosing  a  finite  checking  sequence  with  minimum 
cost,  Cp  .  Since  is  an  order  preserving  function,  if  we 

desire  a  minimum  cost  checking  sequence  of  n  inspection 
times,  then  we  should  choose  an  initial  inspection  time  x, 
that  is  less  than  x|,  the  optimal  initial  inspection  time 
for  an  infinite  sequence  of  inspections.  Then  x  x*  and 

<Cp^{x-), 

Since  X,  <  xj,  the  checking  sequence  generated  from  x, 


82 


will  eventually  result  in  a  negative  inspection  time,  and 
thus  a  finite  number  of  positive  inspection  times  is 
obtained.  The  least  cost  initial  value  of  Xj  can  be  chosen 
so  that  a  checking  sequence  of  exactly  n  inspection  times 
is  obtained,  or  x,  can  be  chosen  so  that  the  checking 
sequence  terminates  at  a  specified  inspection  time. 

As  a  consequence  of  choosing  x,  <  x|,  we  get  smaller 
inspection  intervals  than  those  obtained  by  using  xj.  Thus 
in  the  case  f  is  an  exponential  density,  0  <  P2  <  1,  if  we 
are  interested  in  a  least  cost  finite  checking  sequence,  we 
will  find  that  our  inspection  intervals  will  be  decreasing 
as  opposed  to  constant  inspection  intervals  obtained  for  an 
optimal  infinite  sequence. 

Example  5.5.  Let  f  be  an  exponential  density  with  X=.01, 
f (t) =Xexp (-Xt) ,  t>0.  Choose  a  cost  per  inspection,  Ci=10, 
cost  per  unit  of  failure  time,  C2=l,  and  probability  of 
detecting  a  failure,  P2=.9.  For  an  optimal  infinite 
checking  sequence,  xi=4 1.874  and  constant  checking 
intervals  are  <Sj[=3  6.805  resulting  in  a  cost  of  =  57.075. 

To  obtain  an  optimal  finite  schedule  containing  n=10 
inspection  times,  observe  from  Table  13  that  an  initial 
inspection  time  of  Xi=39  results  in  a  checking  sequence  of 
only  9  inspection  times;  whereas,  an  initial  inspection 
time  of  x,=40  results  in  a  checking  sequence  of  10 


inspection  times.  Also  an  initial  inspection  time  of 
Xi=39.9  also  results  in  a  checking  sequence  of  10 
inspection  times. 


The  cost  of  the  10-inspection  sequence  beginning  at 
Xi=40  is  =  18.898.  The  cost  of  the  10-inspection 

sequence  beginning  at  x,=39.9  is  =  18.669.  Thus  the 

optimal  sequence  for  n=10  begins  at  x,,  where  39  <  Xj  < 
39.9. 

Table  13.  Inspection  Schedules  and  Intervals  for  P2=*9 


for  an  Exponential  Density  X=.01,  c,=10,  C2=l 


Cp2=5.53  5 

Cp2=18. 669 

Cp2=18.898 

B 

Xi 

5;., 

B 

39.00 

39.00 

39.90 

39.90 

40.00 

40.00 

2 

72.11 

33 . 11 

74.16 

34.26 

74.39 

34.39 

3 

103 . 66 

31.55 

107.32 

33 . 17 

107.73 

33 . 35 

B 

133 . 05 

29.39 

138.95 

31.63 

139 . 61 

31.88 

5 

159.49 

26.44 

168.45 

29.50 

169.46 

29.85 

6 

181.99 

22 . 50 

195.04 

26.59 

196.51 

27.05 

B 

199.42 

17 .42 

217.73 

22.70 

219.83 

23 . 32 

8 

210.55 

11.14 

235.40 

17 . 67 

238.28 

18 .46 

9 

214.32 

3.77 

246.83 

bb 

250.67 

12.39 

10 

210.02 

-4.30 

250.93 

4 . 11 

255.87 

5.20 

11 


246.96 


-3.98 


253 . 10 


-2.78 


6. 


IMPERFECT  DETECTION  OF  SOFTWARE  FAULTS 


6.1.  Introduction. 

In  this  chapter  we  present  the  impact  of  Type  II 
inspection  error  on  two  software  fault  detection  models, 
where  the  probability  of  detecting  a  fault  is  0  <  pj  <  1. 

In  Section  6.2  we  introduce  Type  II  error  into  the  Koch  and 
Kubat  (1983)  optimal  release  time  model.  In  Section  6.3  we 
explore  fault  diversity  in  the  Jelinski-Moranda  (JM)  model. 

6.2.  Imperfect  Fault-Detection  Model. 

The  Koch  and  Kubat  (1983)  software  release  time 
decision  model  is  based  on  the  following  function  for  the 
average  number  of  faults  detected  during  testing: 

E[N{T)]  =  M[l-exp(-0T) ]  (6-1) 

where  T  =  software  release  time  (total  testing  time) 

M  =  total  number  of  faults  in  the  software 
prior  to  testing 
6  =  proportionality  constant. 

Next  the  optimal  time,  T,  to  release  software  for 
operational  use  is  obtained  by  maximir:ing  the  average  gain 
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function,  G(T) : 

G{T)  =  cM[  1-exp (-0r)  ]  -  c,T  (6.2) 

where  c,  =  cost  per  rate  of  testing 

Cj  =  cost  of  correcting  a  fault  during  test  phase 
Cj  =  cost  of  correcting  a  fault  during  operational 
phase  (C3  >  Cj) 

C  “•  Cj  “  C2  • 

The  above  cost  factors  presented  by  Bai  and  Yun  (1988)  are 
a  condensed  version  of  the  many  different  cost  factors  used 
by  Koch  and  Kubat  (1983),  and  are  used  here  for  simplicity 
and  ease  of  understanding  the  model.  The  optimal  release 
time,  T,  obtained  by  maximizing  the  average  gain  is  the 
same  as  the  optimal  release  time  obtained  by  minimizing  the 
expected  loss  function  used  by  Okumoto  and  Goel  (1980) . 

Equation  (6.1)  is  identical  in  form  to  the  mean  value 
function  of  the  Goel-Okumoto  (1979)  nonhomogeneous  Poisson 
process  (NHPP)  software  reliability  growth  model  (SRGM) 
with  intensity  function  dE[N(T)]/dT.  Yamada  and  Osaki 
(1985)  categorize  SRGM's  according  to  whether  their  fault 
detection  rate  per  fault  is  increasing,  constant,  or 
decreasing,  where  fault  detection  rate  per  fault  is  defined 
as  r(T)  =  {dE[N(T) ] }/{M-E[N(T) ] } .  For  the  Goel-Okumoto 
NHPP  SRGM,  r(T)  =  0,  which  is  a  constant  fault  detection 
rate  per  fault.  Note  that  in  both  the  Koch  and  Kubat  model 
and  the  Goel-Okumoto  NHPP  SRGM  that  fault  "detection"  is 


operationally  equivalent  to  fault  "occurrence"  because  it 
is  assumed  that  every  fault  that  occurs  is  immediately 
detected  and  corrected. 
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In  the  present  treatment  we  assume  that  a  fault  that 
occurs  may  not  be  detected,  with  probability  qj.  Then  Pj  = 

1  -  q2  is  the  probability  that  a  fault  which  occurs  is 
detected  (and  corrected  immediately) .  This  results  in 
reducing  the  fault  detection  rate  per  fault,  6,  so  that  the 
imperfect  fault  detection  rate  per  fault  is  P20.  Thus  we 
modify  (6.1),  the  average  number  of  faults  detected  during 
a  test  period  of  duration  T,  to 

E[N(T)]  =  Mll-expi-pjdT)  ]  (6.3) 

and  the  average  gain  (6.2)  is  modified  as 

G(T)  =  CM[  1-exp (-P20T)  ]  -  C,T.  (6.4) 

We  obtain  the  optimal  release  time  T^*  by  solving 
dG(T)/dT  =  0  to  get 


Since  d^G(T)/dT^  <0,  Tp‘  maximizes  the  gain.  To  compare 

this  optimal  release  time  to  the  optimal  release  time  T[ 
obtained  by  Koch  and  Kubat  when  P2=l,  we  rewrite  (6.5)  to 
get 
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From  equations  (6.5)  and  (6.6)  we  see  that  if  l/M0>c/c, , 
then  the  optimal  release  time  is  =  0  for  all  P2. 

If  1/M0  <  c/c, ,  then  the  optimal  release  time  is  given  by 
(6.6).  For  1/M0  <  c/Ci,  Figure  6  compares  to  T,.  is 

a  concave  function  of  pj  with  maximum  value  of  Tp’  =  cMIc^e 
at  p2=Cie/cM0. 


1 


Optimal  Release  Time 


Legend 

—  Tp* 

—  Tl* 


Figure  6.  Optimal  Release  Time,  T*. 
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When  0<P2<1,  the  optimum  release  time  Tp*  differs  from 


the  Koch  and  Kubat  optimum  Tj  at  all  but  two  values  of  P2, 
when  P2=l  and  the  value  of  P2  that  solves  the  following 
equation. 


In  P2 


(P2-l)ln 


(6.7) 


From  Figure  6  we  see  that  when  the  probability  of 
detecting  a  fault  is  smaller  than  the  solution  to  (6.7), 

then  the  optimal  release  time  Tp'  is  smaller  than  the 

perfect-detection  optimal  release  time  Tj;  otherwise, 

Tp’  >  r,* ,  when  P2  is  greater  than  the  solution  to  (6.7). 


Example  6.1.  A  numerical  example  is  provided  to  compare 
the  results  of  this  imperfect  fault-detection  model  to  the 
results  obtained  by  Koch  and  Kubat  using  the  values  in 
their  example  1:  c=3500,  c, =21500,  M=30,  0=5/6.  Then 

T|=1.68,  cM/Cie  =  1.80,  c^e/cM0  =  .68,  cJcMO  =  .25.  The 
graph  of  this  particular  example  is  shown  in  Figure  6. 

6.3.  Fault  Diversity  in  the  Jelinski-Moranda  Model. 

Many  software  models  make  the  erroneous  assumption 
that  each  fault  is  equally  likely  to  cause  failure  (and 
thus  equally  likely  to  be  detected) .  Boland,  Proschan,  and 
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Tong  (1987)  p.  185  present  the  impact  of  fault  diversity  in 
models  of  the  Jelinski-Moranda  (JM)  type.  They  assume  that 
N  unknown  faults  in  a  software  system  have  detection  times, 
Zj,  which  are  independent  exponential  random  variables  with 
failure  rates  X  .  Assuming  that  when  a  fault 

occurs,  it  is  detected  and  eliminated,  the  vector  A 
represents  the  diverse  fault  detection  rates  for  the 
system.  Define  T„x  to  be  the  time  until  any  n  faults  in 
the  system  are  eliminated.  Let  A  =  (X,,...,  X^)  and  X'  = 

(X, Xn  '  be  two  vectors  of  fault  detection  rates  for 
two  software  systems.  Boland,  Proschan,  and  Tong  (1987) 
then  prove  that  if  X  >”  X'  (X  majorizes  X')  then  T„x  T„v. 
Thus  the  more  diverse  the  fault  detection  rates  are,  the 
longer  it  takes  to  eliminate  any  n  faults. 

This  section  presents  similar  results  specifically  for 
the  Jelinski-Moranda  model  and  shows  how  fault  diversity  in 
the  JM  model  is  related  to  imperfect  fault  detection. 

Assume  there  are  N  unknown  faults  initially  in  the 
system  and  times  between  fault  detections  are  independent, 
exponentially  distributed  random  variables  Z,.  Then  we 
know  that  in  the  JM  model  for  Z,,  the  time  between  the 
detection  of  the  (i-l)st  and  the  ith  fault,  the  fault 
detection  rate  is  Xj  =  (N-i+l)X,  i=l,...,N,  where  X  is  a 
proportionality  constant.  The  model  assumes  that  faults 
that  occur  are  detected  and  corrected  with  certainty.  We 
can  characterize  the  JM  model  by  the  vector  X  = 
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(X,,...,Xn).  For  a  given  vector  X,  define  the  random 
variable  to  be  the  time  until  the  first  n  faults 
detected  in  the  system  are  eliminated. 

To  show  the  impact  of  fault  diversity,  we  need  the 
following  definition  and  lemma  from  pages  251  and  256  of 
Ross  (1983) . 

Definition  6.1.  The  random  variable  X  is  stochastically 
larger  than  the  random  variable  Y,  written  X  >**  Y  if 
P[X>a]  >  P[Y>a]  for  all  a. 

Lemma  6.1.  Let  X,,  Xj,  ...,  X„  be  independent  and 

Yj,  Yj,  ...»  be  independent.  If  X,  >“  Y,,  then  for  any 

increasing  f,  f(X,,...,X„)  >’'  f  (Y,, . . . ,  Y^)  . 

Theorem  6.1.  Assuming  the  Jelinski-Moranda  model,  let 

X  =  (X,, _ ,Xn)  and  X'  =  (X/,  —  ,Xn')  be  two  vectors  of 

fault  detection  rates  for  two  software  systems,  where  Xj  = 
(N-i+l)X  and  X/  =  (N-i+l)X'.  If  X  <  X'  then  T„x  for 

any  n  <  N. 

Proof .  Xj  =  (N-i+l)X  <  (N-i+l)X'  =  X/  for  all  i=l,...,N. 
Then  P[Zi^a]  =  exp(-Xja)  >  exp(-X/a)  =  P[Z/>a] 
so  that  Zj  >“  Z/.  Define 

n 

. . .  = 

■  •I 
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Since  is  an  increasing  function,  by  Lemma  6.1  we  have 
T„.x  T„,v  for  n  <  N.  I 

Clearly  from  the  definition  of  weak  supermajorization 
in  Chapter  5,  if  X  <  then  X  X',  thus  for  the  JM  model 
our  result  is  similar  to  the  Boland,  Proschan,  and  Tong 
(1987)  Theorem  5.2  p.  186  for  models  of  the  JM  type  which 
requires  majorization  instead  of  weak  supermajorization  to 
conclude  T„,x  >“  T„v- 

From  Theorem  6.1  we  can  conclude  that  if  the  fault 
detection  rate  Xj  for  a  software  system  is  less  than  the 
fault  detection  rate  X/  for  another  software  system,  then 
the  time  to  correction  of  n  faults  for  the  first  system, 

T„x  is  longer  than  the  T„x'  for  the  second  system. 

Now  assume  that  the  probability  that  a  fault  is 
detected  upon  occurrence  is  0  <  p2  <  1.  Once  the  fault  is 
detected  it  is  immediately  corrected.  Suppose  there  are 
two  teams  working  independently  to  correct  faults  in 
identical  software  systems.  The  first  team  detects  faults 
with  probability  0  <  P2  <  1,  while  the  second  team  detects 
faults  with  probability  one.  We  can  describe  the  fault 
correction  rates  for  the  two  teams  as  X;  =  P2X/  and  X/ 
respectively,  then  T„x  T„v.  Thus  imperfect  fault 
detection  increases  fault  correction  time,  as  expected. 
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